6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd

Analysis

max time kernel
57s
max time network
72s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:34

Target

6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe
Size

140KB
MD5

7cb34f66d6e5ce8c0089331d8633be00
SHA1

fc4ee92fa0b5a2a999a1e59e152a72db095c83e9
SHA256

6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd
SHA512

0d17fca72acfff0d658459f05ef0020852922d4d2afcbd0292db9b0fc87f55c18ec186b7d94c5592771489f62978f0bb24b1ebcbf910914e6031d0cfd28b25ca
SSDEEP

3072:YUPvQtzuj/T+6+sy3kvWMxqlqcIXXhQj+WDRKcNUBNlwwE8/x:YUn8CTH+sy3kvnBXWj1wccEe

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1496-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1496-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1496-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1496-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1496	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 1496	656	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe	27
PID 656 wrote to memory of 1496	656	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe	27
PID 656 wrote to memory of 1496	656	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe	27
PID 656 wrote to memory of 1496	656	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe	27

C:\Users\Admin\AppData\Local\Temp\6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe
"C:\Users\Admin\AppData\Local\Temp\6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Users\Admin\AppData\Local\Temp\6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1496

memory/656-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/656-56-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1496-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1496-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1496-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1496-63-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1496-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download