afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:16

Target

afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe
Size

136KB
MD5

83dff20fbc47097d517b98632f8131bf
SHA1

67265b59c512f5bbe2bf9ac40a5455a05a57010e
SHA256

afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c
SHA512

a58596021b484bcb284e58a177b92363d485fa1f3cf675e04e6432983105ba5918244d8a4a2993c8f9efe32d235323135cf22ae7b718ec17692a277101bbe4bd
SSDEEP

3072:RxExbkbji/nU3xKpJ9iyZ/iRgYKKJaVBaaqwbWyPShbAzYh+LdDC:vExSji/nUkrP/z7VzquqlA8haD

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1152-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1152-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1152-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1152-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1152-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1152	4892	afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe	83
PID 4892 wrote to memory of 1152	4892	afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe	83
PID 4892 wrote to memory of 1152	4892	afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe	83

C:\Users\Admin\AppData\Local\Temp\afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe
"C:\Users\Admin\AppData\Local\Temp\afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\afe67254ca46bd5848910155ff13df2b62d7217848724986fad5826ac558622c.exe
  ?
  2⤵
  PID:1152

memory/1152-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1152-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1152-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1152-139-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1152-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1152-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4892-133-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download