0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 11:14

Target

0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe
Size

5.7MB
MD5

71687e0babe1e0575c7471b0e696e9d3
SHA1

d35c21eb3a87f0b579bc9288245ceed59c0e7285
SHA256

0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae
SHA512

fec7763defa039522c66f11cf9ba119c5082b71bd72fa6d3079f0141970e832755137e73f0f9c4e347c08c6d6d456143b424a916e57d8c6362cd35e09e0d3379
SSDEEP

98304:a2TGTcqAxrPncKM26Rmf8aNB47oHwZzQ6z3JPn/XrZhz6PDdGpcj7vwN3QP2R:9qmfWRm9n47lRPn/Xrz6Rqo7WuA

Score

7^/10

upx

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-1-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-2-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-3-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-4-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-5-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-8-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-9-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-10-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-11-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-12-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-13-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-14-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-15-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx
behavioral1/memory/1936-16-0x0000000000D40000-0x0000000001D64000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe
1936	0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	whoami.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1260	1936	0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe	29
PID 1936 wrote to memory of 1260	1936	0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe	29
PID 1936 wrote to memory of 1260	1936	0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe	29

C:\Users\Admin\AppData\Local\Temp\0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe
"C:\Users\Admin\AppData\Local\Temp\0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\whoami.exe
  whoami
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1260

memory/1936-0-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-1-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-2-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-3-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-4-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-5-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-8-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-9-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-10-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-11-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-12-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-13-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-14-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-15-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download
memory/1936-16-0x0000000000D40000-0x0000000001D64000-memory.dmp

Filesize
16.1MB

Download