977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:53

Target

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
Size

59KB
MD5

0a519451c0795cf2c66b8164cb0f8782
SHA1

0b7e97b8a57c699e9d50c6e2138bd1c3c2e6093a
SHA256

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068
SHA512

ce35fc344135eaae88c225665e75f6f3aa48b9d4306d518ab95b346db65468c97cc855acdc6f71de69a37652bb12f34affa9e144c34a241310b557c6cd9056dd
SSDEEP

768:L3wXk6mU7159gO1Wy8D8h5S94K/RA/WBbEJFPNMU6kN6wi+V7+Pjm/Qx8R1:L3ofmU7r/Cwh5ARA/WYdNRN6WVR/+

Score

7^/10

upx

Deletes itself 1 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid process

1944 977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
Executes dropped EXE 1 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid process

1944 977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid	process
1944	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid	process
1944	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1388-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	upx
behavioral2/memory/1944-12-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid process

1388 977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

pid	process
1388	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
1944	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

description	pid	process	target process
PID 1388 wrote to memory of 1944	1388	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
PID 1388 wrote to memory of 1944	1388	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe
PID 1388 wrote to memory of 1944	1388	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe	977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

C:\Users\Admin\AppData\Local\Temp\977f7ba85253542dd75b400d002f3b4b2f367d7620c00d3f0fe21fa156d12068.exe

Filesize
59KB

MD5
64c1f8d0fbe96543fcdea4d235b2f4e1

SHA1
5173a178582620870eb54ae782ae192e82f55254

SHA256
3e1b7f21d7bdf293b98859c732cebb6f8e61c1ffaab3ec55ea6ffc803a785dcd

SHA512
e1a843e6a156f2e5961254a0f0935b88d28b18f022d39184e88bfd41db33a276325ba3177067336f2013fb599ad3f82e6ac5bfc1384802fc042a5afd2f3bc9f7

Download Submit
memory/1388-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1388-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1388-6-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/1388-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1944-12-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1944-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1944-19-0x00000000000C0000-0x00000000000CF000-memory.dmp

Filesize
60KB

Download
memory/1944-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1944-25-0x00000000014C0000-0x00000000014DD000-memory.dmp

Filesize
116KB

Download
memory/1944-26-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download