88511b240e071a0a0d9176a358988a5d1fe05f3e25da30d611e8b8f9713035df

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 13:19

Target

ed6ff2d62a19d64c121459c577f8b570N.exe
Size

36KB
MD5

ed6ff2d62a19d64c121459c577f8b570
SHA1

b9747095876c2588748edfa22668d8861fdcfa0e
SHA256

88511b240e071a0a0d9176a358988a5d1fe05f3e25da30d611e8b8f9713035df
SHA512

1a2a608f7903b1149d0a5fa919ba5ad0d7bda0049cbc8daff88fc65e6c2617450f665c29b0a2a1122883f33f2bc97929ddd225bdf36bf4401de8d8a980dd898f
SSDEEP

768:hrzhXNKKOo25nrrevxlKeEconwbQHE84zJl0wrFPZF8:hKKknXkxlKv5E8OJWg+

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2688	ohsucen.exe

Loads dropped DLL 1 IoCs

pid	Process
304	ed6ff2d62a19d64c121459c577f8b570N.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00090000000120f8-1.dat	upx
behavioral1/memory/2688-5-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ohsucen.exe	ed6ff2d62a19d64c121459c577f8b570N.exe
File created	C:\Windows\SysWOW64\ohsucen.exe	ed6ff2d62a19d64c121459c577f8b570N.exe

C:\Users\Admin\AppData\Local\Temp\ed6ff2d62a19d64c121459c577f8b570N.exe
"C:\Users\Admin\AppData\Local\Temp\ed6ff2d62a19d64c121459c577f8b570N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:304
- C:\Windows\SysWOW64\ohsucen.exe
  "C:\Windows\SysWOW64\ohsucen.exe"
  2⤵
  - Executes dropped EXE
  PID:2688

\Windows\SysWOW64\ohsucen.exe

Filesize
33KB

MD5
dd87da21571a7f49db2086b48dd9f449

SHA1
08c01b06e5a72a9aff47b095cabc471b10b3258b

SHA256
90a91a9dc8104252f62c21e2eae852d0ecb9d7b2085d0679b9b95e2b5bd34672

SHA512
05afa0bbbf77989668b613d93387d2ac6d7446334150332fc72cbc540448e6a644c82e54ea0053e5cf013e3bd504f9e5734cfdfa08741e08dba66821a7a10c95

Download Submit
memory/304-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2688-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download