0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 11:14

Target

0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe
Size

5.7MB
MD5

71687e0babe1e0575c7471b0e696e9d3
SHA1

d35c21eb3a87f0b579bc9288245ceed59c0e7285
SHA256

0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae
SHA512

fec7763defa039522c66f11cf9ba119c5082b71bd72fa6d3079f0141970e832755137e73f0f9c4e347c08c6d6d456143b424a916e57d8c6362cd35e09e0d3379
SSDEEP

98304:a2TGTcqAxrPncKM26Rmf8aNB47oHwZzQ6z3JPn/XrZhz6PDdGpcj7vwN3QP2R:9qmfWRm9n47lRPn/Xrz6Rqo7WuA

Score

7^/10

upx

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3964-0-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-1-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-2-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-4-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-7-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-8-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-10-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-11-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-13-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx
behavioral2/memory/3964-14-0x0000000000F60000-0x0000000001F84000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3964	0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe
3964	0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe

C:\Users\Admin\AppData\Local\Temp\0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe
"C:\Users\Admin\AppData\Local\Temp\0364acd82875d4e6fa56b87fb2dc38499ab79b57b6f04ae15d41762eb9cf76ae.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

memory/3964-0-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-1-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-2-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-4-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-7-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-8-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-10-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-11-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-13-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download
memory/3964-14-0x0000000000F60000-0x0000000001F84000-memory.dmp

Filesize
16.1MB

Download