e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b

Analysis

max time kernel
226s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 12:53

Target

e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
Size

148KB
MD5

07a337f6d5bf45b3125aba176e78d68d
SHA1

1a5a8a53232862e3670b522f7c6a32ba2245c509
SHA256

e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b
SHA512

06a8b215a219fe861c11e65291febdd903cf801e988a1e7cfa5efac8a63148ef486a78dda7f6373b379f7757299eafd858f788a1617c4dd0b06ce68a3b3cbe0c
SSDEEP

3072:gmsLnEneTutcVUZXAwzPDQMbPcUVlffIL7+4NaskiidogE:Kn5utcVUZwwDJQUV63adogE

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/756-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/756-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/756-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/756-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/756-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe

description	pid	process	target process
PID 1156 wrote to memory of 756	1156	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
PID 1156 wrote to memory of 756	1156	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
PID 1156 wrote to memory of 756	1156	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
PID 1156 wrote to memory of 756	1156	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe

C:\Users\Admin\AppData\Local\Temp\e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
"C:\Users\Admin\AppData\Local\Temp\e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Local\Temp\e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
?
2⤵
PID:756

memory/756-54-0x0000000000000000-mapping.dmp

Download
memory/756-56-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/756-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/756-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/756-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/756-62-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/756-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/756-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1156-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download