26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 14:19

Target

26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88N.exe
Size

91KB
MD5

bc6300e498907b7418fc62c4541988a0
SHA1

0a2b7f67a41ae1d1177b13ff9745c7c1fd378956
SHA256

26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88
SHA512

712658b2509f8b79c68a18f97932ba6f949df0fbef5a2baaab891c73f37daab5dcd767a4c1efc86110acb9a3176305d3bb71b0aa763354b03187c156a319b430
SSDEEP

1536:h4cYfpS/6aH73YhHXgcmFhegC0fFaFAQOwGxR:I8rYhHX+FoXWgmQheR

Score

7^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2800	asfesoak-oucoab.exe

Loads dropped DLL 1 IoCs

pid	Process
2704	26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88N.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\asfesoak-oucoab.exe	26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88N.exe
File created	C:\Windows\SysWOW64\asfesoak-oucoab.exe	26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88N.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000e000000012275-1.dat	upx
behavioral1/memory/2800-6-0x0000000000400000-0x0000000000418000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88N.exe
"C:\Users\Admin\AppData\Local\Temp\26e07829cf00d1cc21220fcf80de4ce8360b1befd6cd842449227992b2eeca88N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2704
- C:\Windows\SysWOW64\asfesoak-oucoab.exe
  "C:\Windows\SysWOW64\asfesoak-oucoab.exe"
  2⤵
  - Executes dropped EXE
  PID:2800

\Windows\SysWOW64\asfesoak-oucoab.exe

Filesize
88KB

MD5
39ea6aa0df8191daf1bdf9f416ab86ad

SHA1
334cf58cbf991b917961fd6f4125eef4b6a580bb

SHA256
7075ccc01503f625aa8887ad5dc1ae58661825d431aca6df83a2c49c58f323e8

SHA512
decd3c15f85775175944cef1523bae695afed00a175831b52488ed33d3d8fd67d7c493978621cdd0a4645d2873fb54b6479a8fdc3b4215b52e9323b6ee60a963

Download Submit
memory/2704-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2704-4-0x0000000000020000-0x0000000000038000-memory.dmp

Filesize
96KB

Download
memory/2800-6-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download