15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b

Analysis

max time kernel
207s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:46

Target

15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe
Size

91KB
MD5

0acf4bcaec42293e34e340c6a09bb798
SHA1

114e5b3f2339d5055ffe43e0f327cde9a030e02c
SHA256

15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b
SHA512

07ec9e4336f8efe4efcb95ea841c8199d5bb198ecb16428b661660a73bf40492cfb838afbf0894e4f1c65186eb866fef8a2266a2f90557f5d15682d0aa945d38
SSDEEP

1536:MiTWiQtjknaIAZxHKtReJ7pilV0c/H7UvENZWTslbfwjzE3VTEM39Xn4MjcBGFNY:M2t+HKtmHcYtMbfwATz4MjHNiiPG

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/456-132-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

Processes:

15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe

pid process

456 15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe

pid	process
456	15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe

description	pid	process	target process
PID 456 wrote to memory of 3276	456	15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe	svchost.exe
PID 456 wrote to memory of 3276	456	15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe	svchost.exe
PID 456 wrote to memory of 3276	456	15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe	svchost.exe
PID 456 wrote to memory of 3276	456	15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe	svchost.exe
PID 456 wrote to memory of 3276	456	15a75ca7a9f21558967107f1886c68ba522d4ede86a8fe343c0b3f4189f91c3b.exe	svchost.exe

memory/456-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/456-134-0x00000000005B0000-0x00000000005C3000-memory.dmp

Filesize
76KB

Download
memory/456-135-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/456-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3276-133-0x0000000000000000-mapping.dmp

Download