6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:34

Target

6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe
Size

140KB
MD5

7cb34f66d6e5ce8c0089331d8633be00
SHA1

fc4ee92fa0b5a2a999a1e59e152a72db095c83e9
SHA256

6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd
SHA512

0d17fca72acfff0d658459f05ef0020852922d4d2afcbd0292db9b0fc87f55c18ec186b7d94c5592771489f62978f0bb24b1ebcbf910914e6031d0cfd28b25ca
SSDEEP

3072:YUPvQtzuj/T+6+sy3kvWMxqlqcIXXhQj+WDRKcNUBNlwwE8/x:YUn8CTH+sy3kvnBXWj1wccEe

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5060-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5060-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5060-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5060-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5060-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5060	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 5060	2556	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe	81
PID 2556 wrote to memory of 5060	2556	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe	81
PID 2556 wrote to memory of 5060	2556	6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe	81

C:\Users\Admin\AppData\Local\Temp\6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe
"C:\Users\Admin\AppData\Local\Temp\6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\6a2fca1bcaa33fea419380e3ea2ac7204130c9b94e5cf61ddecfc483c2ae78bd.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5060

memory/2556-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5060-134-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5060-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5060-136-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5060-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5060-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5060-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5060-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download