2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297

Analysis

max time kernel
163s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 02:20

Target

2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe
Size

136KB
MD5

4d2df8162d352269ed3559828284166a
SHA1

288fa17603bc71e1c0d51b8ce575c7ea879a2927
SHA256

2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297
SHA512

310ca898c35d64b4a01ac8088875642ac81465f3f1538057bd03b52bc7aa580fffda379cfe3cdb8c7eb000287f31484823118de8294c756e92ca31c4ef308ccd
SSDEEP

3072:R5Exbkbji/P2CyEif779iyZ/iRgYKKJaVBaaqwbWyPShbAzYh3LdDC:HExSji/QT7P/z7VzquqlA8hBD

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4376-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4376-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4376-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4376-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4376-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4376	4632	2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe	84
PID 4632 wrote to memory of 4376	4632	2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe	84
PID 4632 wrote to memory of 4376	4632	2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe	84

C:\Users\Admin\AppData\Local\Temp\2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe
"C:\Users\Admin\AppData\Local\Temp\2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\2e92dc33ffa7a106faa0793369d77714f21ad4d4efb9f73f2a0dbc2c197f0297.exe
  ?
  2⤵
  PID:4376

memory/4376-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4376-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4376-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4376-140-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4376-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4376-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4632-139-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download