9dbe2bff2ff6fdc92da92b98e8cf067df5a21ce0f351a47c2ccc190d590ba2dc

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 16:37

Target

win.exe
Size

5.7MB
MD5

e42a8e96e08ce2e22fade2309798e4ad
SHA1

2d8fe944dba6631211a694408a6de9e12be05b5b
SHA256

9dbe2bff2ff6fdc92da92b98e8cf067df5a21ce0f351a47c2ccc190d590ba2dc
SHA512

39e0b2c0b6762026843ab244a2a6d54d558d56a941ce3f68a84e6390719f721473da977564922d694533d7b7b4fd86f0b2b423a3cfcef4c804d2e5f51fce220c
SSDEEP

98304:RxGruILthS1y28otHB7fpJKbM89c87LGwPXIm6PDokA7+Iqtdd8Spaz:RQaIUy3kB7vKb19l7zPv6MYIqHddp

Score

7^/10

upx

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4988-0-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/4988-3-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-2-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-4-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-7-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-8-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-10-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-11-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-13-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-14-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-16-0x0000000000910000-0x0000000001936000-memory.dmp	upx
behavioral2/memory/3624-17-0x0000000000910000-0x0000000001936000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

win.exewin.exe

pid process

4988 win.exe
3624 win.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

win.exe

description pid process target process

PID 4988 wrote to memory of 3624 4988 win.exe win.exe
PID 4988 wrote to memory of 3624 4988 win.exe win.exe

pid	process
4988	win.exe
3624	win.exe

description	pid	process	target process
PID 4988 wrote to memory of 3624	4988	win.exe	win.exe
PID 4988 wrote to memory of 3624	4988	win.exe	win.exe

C:\Users\Admin\AppData\Local\Temp\win.exe
C:\Users\Admin\AppData\Local\Temp\win.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3624

memory/3624-2-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-4-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-7-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-8-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-10-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-11-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-13-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-14-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-16-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/3624-17-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/4988-0-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download
memory/4988-3-0x0000000000910000-0x0000000001936000-memory.dmp

Filesize
16.1MB

Download