6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 01:30

Target

6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe
Size

67KB
MD5

19d8870328727e29ec8469b12384a580
SHA1

18a21fe542e35e5abe46bca99800e8752e7d094b
SHA256

6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b
SHA512

52647f68dedf7fb4120bcb59885848eed0b90d55cf2177195fd14c5ac4730a40ce9b9d9d21d842a855c0a6362e939d6f27c3aed7452400c399dda43694f15da7
SSDEEP

768:Erzce4ewyX6RNHHVo0nDiZnLGcxeeFKHYGIDMkDT:E0h7ueHVJcycx4gT

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
5028	rmass.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x000800000002322b-4.dat	upx
behavioral2/memory/5028-5-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe
File created	C:\Windows\SysWOW64\rmass.exe	6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe

C:\Users\Admin\AppData\Local\Temp\6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe
"C:\Users\Admin\AppData\Local\Temp\6dcbfe38306233f61ef5470e657cf506da30ade8d13b7845078477764c80016b.exe"
1⤵
- Drops file in System32 directory
PID:4048
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:2920

C:\Windows\SysWOW64\rmass.exe

Filesize
64KB

MD5
5493d70433604664c991616c86ee95d1

SHA1
4fdbedda2a921f64d5236075c5240804e954d862

SHA256
5fc5513268a578bc8f2ca0df37994e83e86f6011fe4815091076405c46477743

SHA512
234c7d82d2388ee0a0b10b245e9b9fb08012175b223d5b9ea6aeacb847119bfbf99c4bd61f1efeb547a913718cee31417e0ceb026697bb219702999f738678e8

Download Submit
memory/4048-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4048-1-0x0000000076FF2000-0x0000000076FF3000-memory.dmp

Filesize
4KB

Download
memory/5028-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download