4e5e274efb5b3f1cd95aed866f85457daa6ff7dd56d9ce22bf459e4a2900d5c5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 00:00

Target

17f733daaaf02d0293a1c74946bc67b0N.exe
Size

23KB
MD5

17f733daaaf02d0293a1c74946bc67b0
SHA1

b3ead02d1dc1858e5f3f3ee58c99c85a3fc38d76
SHA256

4e5e274efb5b3f1cd95aed866f85457daa6ff7dd56d9ce22bf459e4a2900d5c5
SHA512

cbdc82faa3a4eb58e6f7624768e4012b717b38c24390379d5966e7aace6521ec20de585020da97fb7e8b25e483d6ebc8279f97522789d49b019df694c79e0636
SSDEEP

384:ErzPZnmAXvK14dirr4tGjSz28MrHI0nTfSPt1rzMjkj8r6V+7p+nazEa:ErzFXvKadiQi8MLdbAt1QO8reYAazj

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1948	rmass.exe

Loads dropped DLL 1 IoCs

pid	Process
3044	17f733daaaf02d0293a1c74946bc67b0N.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00090000000120f1-1.dat	upx
behavioral1/memory/3044-2-0x0000000000020000-0x0000000000031000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	17f733daaaf02d0293a1c74946bc67b0N.exe
File created	C:\Windows\SysWOW64\rmass.exe	17f733daaaf02d0293a1c74946bc67b0N.exe

C:\Users\Admin\AppData\Local\Temp\17f733daaaf02d0293a1c74946bc67b0N.exe
"C:\Users\Admin\AppData\Local\Temp\17f733daaaf02d0293a1c74946bc67b0N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:3044
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:1948

\Windows\SysWOW64\rmass.exe

Filesize
20KB

MD5
5af5de6ed4a90a0405c5961137a9ace9

SHA1
c07efa271e42ac3ca7b25110dc2a49d80fb240fa

SHA256
f5318a8d18c3006ce0dd57ac377e3a9cdbeb270dc610e01545b4318546e90893

SHA512
688c43216ee50f4f17c1e420121a9c6144b5533e41f53ffa3596d68d86e0d9544b416945839898af94722787711afcf828f587a4f5461cee604c529eab1e5779

Download Submit
memory/3044-2-0x0000000000020000-0x0000000000031000-memory.dmp

Filesize
68KB

Download
memory/3044-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download