2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 02:20

Target

2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe
Size

136KB
MD5

4d2df8162d352269ed3559828284166a
SHA1

288fa17603bc71e1c0d51b8ce575c7ea879a2927
SHA256

2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297
SHA512

310ca898c35d64b4a01ac8088875642ac81465f3f1538057bd03b52bc7aa580fffda379cfe3cdb8c7eb000287f31484823118de8294c756e92ca31c4ef308ccd
SSDEEP

3072:R5Exbkbji/P2CyEif779iyZ/iRgYKKJaVBaaqwbWyPShbAzYh3LdDC:HExSji/QT7P/z7VzquqlA8hBD

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2040-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2040-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2040-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2040-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2040	1184	2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe	27
PID 1184 wrote to memory of 2040	1184	2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe	27
PID 1184 wrote to memory of 2040	1184	2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe	27
PID 1184 wrote to memory of 2040	1184	2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe	27

C:\Users\Admin\AppData\Local\Temp\2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe
"C:\Users\Admin\AppData\Local\Temp\2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe
  ?
  2⤵
  PID:2040

memory/1184-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1184-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2040-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-63-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2040-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download