e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb

Analysis

max time kernel
153s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 22:06

Target

e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe
Size

69KB
MD5

5a9ebff90152436a6d608b3ed9ca74a1
SHA1

19ccb01571097dba96046b64aac27ce61866a430
SHA256

e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb
SHA512

2902c13544195cccd6891bf390960ecc0fe88ebd949b52ad8fa8dc55465490b3d9d2d3f9f7b4cc992c1564f5c5dfad8d2482133f12ce0f67814044b4a5b6dd36
SSDEEP

1536:oJmlQnHfBsMagfJwLjZvRz/2+scAzJ72KxniskZbKOTJ38OgIdi:5lu5LasC9VDsHzDxniskZedu

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/896-54-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 1692	896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe	28
PID 896 wrote to memory of 1692	896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe	28
PID 896 wrote to memory of 1692	896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe	28
PID 896 wrote to memory of 1692	896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe	28
PID 896 wrote to memory of 1692	896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe	28
PID 896 wrote to memory of 1692	896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe	28
PID 896 wrote to memory of 1692	896	e4f79e6137bc5366312168ec99f515d9b6fdb6b5bf5f87ca20ea38a9e7c202fb.exe	28

memory/896-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/896-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1692-55-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1692-57-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1692-60-0x0000000000F00000-0x0000000000F08000-memory.dmp

Filesize
32KB

Download
memory/1692-61-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download