e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 12:53

Target

e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
Size

148KB
MD5

07a337f6d5bf45b3125aba176e78d68d
SHA1

1a5a8a53232862e3670b522f7c6a32ba2245c509
SHA256

e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b
SHA512

06a8b215a219fe861c11e65291febdd903cf801e988a1e7cfa5efac8a63148ef486a78dda7f6373b379f7757299eafd858f788a1617c4dd0b06ce68a3b3cbe0c
SSDEEP

3072:gmsLnEneTutcVUZXAwzPDQMbPcUVlffIL7+4NaskiidogE:Kn5utcVUZwwDJQUV63adogE

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4536-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4536-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4536-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4536-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4536-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe

description	pid	process	target process
PID 544 wrote to memory of 4536	544	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
PID 544 wrote to memory of 4536	544	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
PID 544 wrote to memory of 4536	544	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe	e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe

C:\Users\Admin\AppData\Local\Temp\e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
"C:\Users\Admin\AppData\Local\Temp\e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\e054b4ada5d2675a406a7780588f4159b2d7f2457f0a524c596fb107fbe1064b.exe
?
2⤵
PID:4536

memory/544-133-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4536-132-0x0000000000000000-mapping.dmp

Download
memory/4536-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4536-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4536-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4536-139-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4536-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4536-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download