1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:11

Target

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
Size

41KB
MD5

6260eb8f66f79eb24188cd3df6994412
SHA1

e1a8e367c06644ddb8c003807d587d12ba25d724
SHA256

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9
SHA512

b7361682db2c58a52fcc57f66ed320882a9f3919615f8c7bf0fb6d3c77332f4ae39fabb6395026e8fefaddc3b7899ab90ed18ea61385c6af01c7fab0b5488141
SSDEEP

768:WmNn7hiC8hT0zYmMUten89HuxLpxgKK3CU/OjSN:WmNn7hif0zYRUgnVJpxgKoCUdN

Score

9^/10

upx

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3052-1-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/3052-6-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/3052-5-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/3052-4-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral1/memory/3052-9-0x0000000010000000-0x000000001000F000-memory.dmp	UPX

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/3052-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/3052-6-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/3052-5-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/3052-4-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/3052-9-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

description	pid	process	target process
PID 1720 wrote to memory of 3052	1720	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 1720 wrote to memory of 3052	1720	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 1720 wrote to memory of 3052	1720	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 1720 wrote to memory of 3052	1720	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
"C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
?
2⤵
PID:3052

memory/1720-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3052-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3052-6-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3052-5-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3052-4-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3052-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3052-9-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download