a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3

Analysis

max time kernel
33s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 00:19

Target

a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe
Size

34KB
MD5

0e839fd362468e6beabac89c02f341b0
SHA1

e9c841d44d7ea0e4e46a52d6130c6c2bbb23634a
SHA256

a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3
SHA512

04897ed29defc1a80d67dbb30eeb2f73e95d3504b880ef6aecb60e2c24bd831bd8bafdc7dbd27282efce0f101fff6055420afd49859a7e56aa6f61b84b88a331
SSDEEP

768:voKzaGs83Ty0nJKpYMi3wp9CvD3kr/nbcuyD7UTsOKBdfI:keJKpRi3wCvDqnouy8AFdfI

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3096-132-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3096	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe
3096	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3208	3096	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe	34
PID 3096 wrote to memory of 3208	3096	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe	34
PID 3096 wrote to memory of 3208	3096	a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe	34

C:\Users\Admin\AppData\Local\Temp\a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe
"C:\Users\Admin\AppData\Local\Temp\a06d9c36bee1330412221b559766344138db8b1b27133be8826490359cbd38a3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\syswow64\svchost.exe"
  2⤵
  PID:3208

memory/3096-132-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3096-133-0x00000000021A0000-0x00000000022A3000-memory.dmp

Filesize
1.0MB

Download
memory/3208-136-0x00000000012D0000-0x00000000012D3000-memory.dmp

Filesize
12KB

Download
memory/3208-135-0x0000000000130000-0x000000000013E000-memory.dmp

Filesize
56KB

Download