ca0c190da6848ef18c8e881f4d50d57d0c5c956ac62f301f664e4e12a341e63e

Analysis

max time kernel
153s
max time network
161s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 19:59

Target

ca0c190da6848ef18c8e881f4d50d57d0c5c956ac62f301f664e4e12a341e63e.exe
Size

341KB
MD5

79d18776ad6fdfc7c6cd9c350106eee0
SHA1

1163cfc81ae5ede494893f784e084eff50d9293b
SHA256

ca0c190da6848ef18c8e881f4d50d57d0c5c956ac62f301f664e4e12a341e63e
SHA512

dd3e656c640d0f9c0f4cf1bce32323379ca153bacaacbbffd3aa14e2f294be88f4dd8c4bff32916f2d37e68a8a791bba45c19ea5e1633df24f81ff037bc8a531
SSDEEP

6144:5Kijkqa0S4WhxkTuWpovm53ij/gzCp4sJss4x8laE1qdrlRoXTef:5PYdth+poo3i/xJsRxV9nRZ

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1872-54-0x0000000000400000-0x00000000004B4000-memory.dmp	upx
behavioral1/memory/1872-55-0x0000000000400000-0x00000000004B4000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1872	ca0c190da6848ef18c8e881f4d50d57d0c5c956ac62f301f664e4e12a341e63e.exe

C:\Users\Admin\AppData\Local\Temp\ca0c190da6848ef18c8e881f4d50d57d0c5c956ac62f301f664e4e12a341e63e.exe
"C:\Users\Admin\AppData\Local\Temp\ca0c190da6848ef18c8e881f4d50d57d0c5c956ac62f301f664e4e12a341e63e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1872

memory/1872-54-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1872-55-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download