2f348d6a86b7c5196f1e8e44de7e4f4716707af48367e3746e960bf0099c8fdf

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 13:02

Target

3edf17f985bf68be123edc894fd61190N.exe
Size

5.7MB
MD5

3edf17f985bf68be123edc894fd61190
SHA1

8e2cd7b91073c1d792972742b89974f3ccfec3c7
SHA256

2f348d6a86b7c5196f1e8e44de7e4f4716707af48367e3746e960bf0099c8fdf
SHA512

051a23653fbae90df49e28f8a059eee681e7c19ae33df3be865929332a84a14ed198979fbbcaa410cfa78900f8384bb8a0dbf40fc873ffe8c0f703c0738208e4
SSDEEP

98304:gCQUA1OjhJTlBR1AebLrfjBevMu9Rqxkgn6lnwOmQvcQunlmoixgeXueb1:gCPhh1RrbLrfjBYRFbnR1EQunlmokgeb

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2056-0-0x000000013F7A0000-0x00000001402B0000-memory.dmp	upx
behavioral1/memory/2056-2-0x000000013F7A0000-0x00000001402B0000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2056	3edf17f985bf68be123edc894fd61190N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2800	2056	3edf17f985bf68be123edc894fd61190N.exe	30
PID 2056 wrote to memory of 2800	2056	3edf17f985bf68be123edc894fd61190N.exe	30
PID 2056 wrote to memory of 2800	2056	3edf17f985bf68be123edc894fd61190N.exe	30

C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe
"C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe
  "C:\Users\Admin\AppData\Local\Temp\3edf17f985bf68be123edc894fd61190N.exe"
  2⤵
  PID:2800

memory/2056-0-0x000000013F7A0000-0x00000001402B0000-memory.dmp

Filesize
11.1MB

Download
memory/2056-1-0x0000000001DA0000-0x00000000028B0000-memory.dmp

Filesize
11.1MB

Download
memory/2056-2-0x000000013F7A0000-0x00000001402B0000-memory.dmp

Filesize
11.1MB

Download
memory/2056-4-0x0000000001DA0000-0x00000000028B0000-memory.dmp

Filesize
11.1MB

Download