6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 01:30

Target

6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe
Size

67KB
MD5

19d8870328727e29ec8469b12384a580
SHA1

18a21fe542e35e5abe46bca99800e8752e7d094b
SHA256

6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b
SHA512

52647f68dedf7fb4120bcb59885848eed0b90d55cf2177195fd14c5ac4730a40ce9b9d9d21d842a855c0a6362e939d6f27c3aed7452400c399dda43694f15da7
SSDEEP

768:Erzce4ewyX6RNHHVo0nDiZnLGcxeeFKHYGIDMkDT:E0h7ueHVJcycx4gT

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2244	rmass.exe

Loads dropped DLL 1 IoCs

pid	Process
1100	6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000a00000001466c-1.dat	upx
behavioral1/memory/1100-2-0x0000000000020000-0x0000000000032000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe
File created	C:\Windows\SysWOW64\rmass.exe	6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe

C:\Users\Admin\AppData\Local\Temp\6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe
"C:\Users\Admin\AppData\Local\Temp\6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1100
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:2244

\Windows\SysWOW64\rmass.exe

Filesize
64KB

MD5
5493d70433604664c991616c86ee95d1

SHA1
4fdbedda2a921f64d5236075c5240804e954d862

SHA256
5fc5513268a578bc8f2ca0df37994e83e86f6011fe4815091076405c46477743

SHA512
234c7d82d2388ee0a0b10b245e9b9fb08012175b223d5b9ea6aeacb847119bfbf99c4bd61f1efeb547a913718cee31417e0ceb026697bb219702999f738678e8

Download Submit
memory/1100-2-0x0000000000020000-0x0000000000032000-memory.dmp

Filesize
72KB

Download
memory/1100-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download