05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 02:37

Target

05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe
Size

71KB
MD5

0901828f9263b9aa5fd7d8d92571f360
SHA1

68ea87740ad7ed4c3b882e382f079f1e67bb90bd
SHA256

05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203
SHA512

5b87a73cb06535e7e4f191f14b65e01bb27180f45e88e3165aa43e3d011c7c8ba80e5d2c3f337fa3ee33a2374dd6c892eaad882cd2693a9d9a787caee6fddfb6
SSDEEP

1536:WtjxZ0O4j7zjKEB6TW3CwaiilqCh19UkocdNzPFQ9uBs/p:8jbEgCSw4h19EcDzPFQk+/p

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/948-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/948-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/948-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/948-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/948-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 948	992	05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe	28
PID 992 wrote to memory of 948	992	05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe	28
PID 992 wrote to memory of 948	992	05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe	28
PID 992 wrote to memory of 948	992	05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe	28

C:\Users\Admin\AppData\Local\Temp\05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe
"C:\Users\Admin\AppData\Local\Temp\05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\05abed42459e8b4d14cc3fc9e4945250a1544b2d392a6e7ee35090e8ce406203.exe
  ?
  2⤵
  PID:948

memory/948-54-0x0000000000000000-mapping.dmp

Download
memory/948-57-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/948-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/948-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/948-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/948-63-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/948-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/948-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/992-55-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/992-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download