fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 05:16

Target

fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d.exe
Size

4.3MB
MD5

4df7d480b4e3a1e456a9e77a735055bd
SHA1

8483298d6229b3b1a0feb842018cb4814550f911
SHA256

fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d
SHA512

f4f8786bc83b1222ae4936435451387e703a825867e7f04ba8e5a4eb48d8bdf32d97eafa288619e62cfc9ee4c4cf66316428addfe5c43f1128657cea313a2d0f
SSDEEP

98304:DaaaaaaaaaaaaaaaaaaaaaaaaaM888888888888888888888888888888888g:3888888888888888888888888888888j

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

svrwsc.exe

pid process

1252 svrwsc.exe
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral2/memory/4580-0-0x0000000000400000-0x000000000042B000-memory.dmp upx
C:\Windows\SysWOW64\svrwsc.exe upx
Drops file in System32 directory 2 IoCs

Processes:

fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d.exesvrwsc.exe

description ioc process

File created C:\Windows\SysWOW64\svrwsc.exe fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d.exe
File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe

pid	process
1252	svrwsc.exe

resource	yara_rule
behavioral2/memory/4580-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
C:\Windows\SysWOW64\svrwsc.exe	upx

description	ioc	process
File created	C:\Windows\SysWOW64\svrwsc.exe	fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d.exe
File created	C:\Windows\SysWOW64\svrwsc.exe	svrwsc.exe

C:\Users\Admin\AppData\Local\Temp\fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d.exe
"C:\Users\Admin\AppData\Local\Temp\fe0e520333731ea46e0a6541d40ae14131bb82bc6c232ffbc1a07045da5a2b5d.exe"
1⤵
- Drops file in System32 directory
PID:4580

C:\Windows\SysWOW64\svrwsc.exe
Filesize
4.5MB

MD5
5be711dbf46a3ca21058cbc7aeaf6840

SHA1
7a41ff563cdb49c6d83601234cfb5974043f87e5

SHA256
6b2387f6662ec9ab8a17c7c0028da8004af2fe6518c0ab10c9888c02edde2b9d

SHA512
26be84d05b105eb3dc63f91cf772d169d1b3fe0988e3307ccc1eab945eb926b8446c9db56727a8725c601cb52a836fcf3d940a064525593879ae790f5a8c4ab6

Download Submit
memory/1252-7-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1252-5-0x00007FF9DADD0000-0x00007FF9DAFC5000-memory.dmp

Filesize
2.0MB

Download
memory/1252-10-0x00007FF9DADD0000-0x00007FF9DAFC5000-memory.dmp

Filesize
2.0MB

Download
memory/1252-11-0x00007FF9DADD0000-0x00007FF9DAFC5000-memory.dmp

Filesize
2.0MB

Download
memory/4580-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4580-1-0x00007FF9DADD0000-0x00007FF9DAFC5000-memory.dmp

Filesize
2.0MB

Download
memory/4580-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download