c0a029763dce25a25915ecd9578020aee6833bd030ad8598b254755b306ae7af

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 01:24

Target

c0a029763dce25a25915ecd9578020aee6833bd030ad8598b254755b306ae7af.exe
Size

4.9MB
MD5

f5402c009b189b8558e0d8ca5542d5df
SHA1

b6fe0ac505d39b8ac4db9c299c1aa41bc4765f11
SHA256

c0a029763dce25a25915ecd9578020aee6833bd030ad8598b254755b306ae7af
SHA512

3c40725cf0584877df6bcb49befb197922d7f104c7926448feef9d00c31e12bf670a41cca33daba08c1e9c7625110710b49f1bef941bb2d33196638610a1bcc6
SSDEEP

98304:bqFfnjxXaW18wxvUFSYhwjwQBanx25ZEnmEspHWanWCqkjPlw/xjtFy9:+tlXt8wVUFzSjwQBcU5ZQmEspl5NwzFy

Score

7^/10

upx

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1512-0-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-1-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-3-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-4-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-7-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-8-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-10-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-11-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-13-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx
behavioral2/memory/1512-14-0x00000000009F0000-0x00000000018FB000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	c0a029763dce25a25915ecd9578020aee6833bd030ad8598b254755b306ae7af.exe
1512	c0a029763dce25a25915ecd9578020aee6833bd030ad8598b254755b306ae7af.exe

C:\Users\Admin\AppData\Local\Temp\c0a029763dce25a25915ecd9578020aee6833bd030ad8598b254755b306ae7af.exe
"C:\Users\Admin\AppData\Local\Temp\c0a029763dce25a25915ecd9578020aee6833bd030ad8598b254755b306ae7af.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1304,i,12101950716832706950,8384629015980369538,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
1⤵
PID:688

memory/1512-0-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-1-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-3-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-4-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-7-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-8-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-10-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-11-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-13-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download
memory/1512-14-0x00000000009F0000-0x00000000018FB000-memory.dmp

Filesize
15.0MB

Download