bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 01:30

Target

bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e.exe
Size

24KB
MD5

23669bf335b4a38a91adb7dbe9ab4c79
SHA1

aa9403d12c1e5630d47cfcd9859122aca027a0d6
SHA256

bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e
SHA512

87722ae5869d08cb24d793756f8dd310c024d7127ba625c81aa1ae7766158286db3a2d92a8beceb1bb8657c7ac43494c42646bf14e7c2212fb6b21d94a45c9a9
SSDEEP

384:ErzPTRakFXfEln49mxSZHrXnKf98BLVa5L0vMtFob1OKrBGgVuaRG6Df+1:ErzTlXfKc4EHrXI98BA0v2a5YgVuUk

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2540	rmass.exe

Loads dropped DLL 1 IoCs

pid	Process
1924	bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rmass.exe	bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e.exe
File created	C:\Windows\SysWOW64\rmass.exe	bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00070000000120fe-1.dat	upx
behavioral1/memory/2540-5-0x0000000000400000-0x0000000000411000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e.exe
"C:\Users\Admin\AppData\Local\Temp\bc3bf659f5119b5df317fa0df5a35bd181f197d308ba942381882e445124e14e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1924
- C:\Windows\SysWOW64\rmass.exe
  "C:\Windows\SysWOW64\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:2540

\Windows\SysWOW64\rmass.exe

Filesize
21KB

MD5
161ac62a9641757f3020c1db502808de

SHA1
7f8eddbee702013c93a5b0a98943cbf0f06cce13

SHA256
688fa98224e168cae037365f5be330472d39cfa4283b7b3c399bc0c7a36b3e7d

SHA512
43feb69f68d958aa30a50e85feefef32111281c388c6a913ccf1b1ff93dd8345fbbf727bff0f154682249ab50b7cde1db798a34dd0bd0674ca8498c55016b5a5

Download Submit
memory/1924-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2540-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download