1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:11

Target

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
Size

41KB
MD5

6260eb8f66f79eb24188cd3df6994412
SHA1

e1a8e367c06644ddb8c003807d587d12ba25d724
SHA256

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9
SHA512

b7361682db2c58a52fcc57f66ed320882a9f3919615f8c7bf0fb6d3c77332f4ae39fabb6395026e8fefaddc3b7899ab90ed18ea61385c6af01c7fab0b5488141
SSDEEP

768:WmNn7hiC8hT0zYmMUten89HuxLpxgKK3CU/OjSN:WmNn7hif0zYRUgnVJpxgKoCUdN

Score

9^/10

upx

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2548-1-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/2548-4-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/2548-5-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/2548-6-0x0000000010000000-0x000000001000F000-memory.dmp	UPX
behavioral2/memory/2548-9-0x0000000010000000-0x000000001000F000-memory.dmp	UPX

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2548-1-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2548-4-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2548-5-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2548-6-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2548-9-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

description	pid	process	target process
PID 1496 wrote to memory of 2548	1496	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 1496 wrote to memory of 2548	1496	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
PID 1496 wrote to memory of 2548	1496	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe	1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe

C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
"C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Local\Temp\1c5a4e8d314f006e48b309cc33fcdb3bab7e20d07feebfc147a39301d95249d9.exe
?
2⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3608

memory/1496-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2548-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2548-4-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2548-5-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2548-6-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2548-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2548-9-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download