adae8ebf8a54d9a5c7678809bcef992b0b7ce2fad69d8f76fac3f1d2a204b621

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 09:43

Target

c223742ec9675d4174a46616bd8fcb10N.exe
Size

65KB
MD5

c223742ec9675d4174a46616bd8fcb10
SHA1

83a4c9c603831ef1cf6fb08e99fae8d1a983fd6d
SHA256

adae8ebf8a54d9a5c7678809bcef992b0b7ce2fad69d8f76fac3f1d2a204b621
SHA512

63917b01c8750bcebc10daf123f7b0b20685ed80dfde4c857ca9958c8107bf76a23013716f57f1c0c157498d8e3f0cc2394150797e1fc93647b72e76713a14b3
SSDEEP

768:ErzL2iP0n1gMLsq2DwXfisMeNgBMi3Hm/9FLxLQdKhrsTdz4/qXxfF8F/sWgyg:EPMLZXfXfG5m/9RxL+ish4iXxv

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1212	rmass.exe

Loads dropped DLL 1 IoCs

pid	Process
2084	c223742ec9675d4174a46616bd8fcb10N.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000c00000001226d-4.dat	upx
behavioral1/memory/1212-5-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	c223742ec9675d4174a46616bd8fcb10N.exe
File created	C:\Windows\SysWOW64\rmass.exe	c223742ec9675d4174a46616bd8fcb10N.exe

C:\Users\Admin\AppData\Local\Temp\c223742ec9675d4174a46616bd8fcb10N.exe
"C:\Users\Admin\AppData\Local\Temp\c223742ec9675d4174a46616bd8fcb10N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2084
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:1212

C:\Windows\SysWOW64\rmass.exe

Filesize
62KB

MD5
fb6762ef73671ae00c22eb2e0a3eac20

SHA1
851665977cecca8bfa00f8089c2a7a72a1b30af6

SHA256
9a4829214f523e107108ca496af4eeb66b123f87d25b87e3c288ba140807d74d

SHA512
b3f9929e3e6f3a988deab938d8ae6942f7ff70cc89be53221b73464a5f5fc67b901cad96840aaaa058764550746030ba9d015570b21234cfeaa49b0e038cf7f5

Download Submit
memory/1212-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2084-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download