afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:16

Target

afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe
Size

136KB
MD5

83dff20fbc47097d517b98632f8131bf
SHA1

67265b59c512f5bbe2bf9ac40a5455a05a57010e
SHA256

afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c
SHA512

a58596021b484bcb284e58a177b92363d485fa1f3cf675e04e6432983105ba5918244d8a4a2993c8f9efe32d235323135cf22ae7b718ec17692a277101bbe4bd
SSDEEP

3072:RxExbkbji/nU3xKpJ9iyZ/iRgYKKJaVBaaqwbWyPShbAzYh+LdDC:vExSji/nUkrP/z7VzquqlA8haD

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1368-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1368-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1368-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1368-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1368-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1368	1972	afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe	28
PID 1972 wrote to memory of 1368	1972	afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe	28
PID 1972 wrote to memory of 1368	1972	afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe	28
PID 1972 wrote to memory of 1368	1972	afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe	28

C:\Users\Admin\AppData\Local\Temp\afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe
"C:\Users\Admin\AppData\Local\Temp\afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe
  ?
  2⤵
  PID:1368

memory/1368-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-63-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1368-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1972-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download