18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 22:06

Target

18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36.exe
Size

91KB
MD5

9d5280a11c3440c883cc1877b8a9c0ae
SHA1

d26f9803af9667ed00390c4eadec83b3cbf3f937
SHA256

18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36
SHA512

e888f3d7bb21207a18727e492e10dc6e4206f52a9ffbc177db5c53ca61166166615023b5ecad5ea4e81901afc984d3419b5a2ab5e11247e080060f3259754823
SSDEEP

1536:j1mfdljDNCbhKoywNHUePbUieQZaaeba/Xv31yOEvllDuMp2tM/ZyIIqEUU:8Pg5jZRZhXH31EvllRp2q/ZyUU

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4204-132-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4204	18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4968	4204	18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36.exe	80
PID 4204 wrote to memory of 4968	4204	18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36.exe	80
PID 4204 wrote to memory of 4968	4204	18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36.exe	80
PID 4204 wrote to memory of 4968	4204	18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36.exe	80
PID 4204 wrote to memory of 4968	4204	18e607ba1e5b8bdd1e441987669e89d549b96d22244acb0fd035fea5c3624a36.exe	80

memory/4204-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4204-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download