e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4

Analysis

max time kernel
30s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:36

Target

e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe
Size

26KB
MD5

05a08225ab7c5e62983c9805c89d8d8a
SHA1

628c64ae6329bff90edec532c417bfce0f6501b6
SHA256

e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4
SHA512

adbe830054b7cb766b1fa3517f91ad0a3d365de94d8cea36d1c57f8daed46d4a0ed221887042a3eb0228d25706be7901e8718015b552f3af082e63589d129471
SSDEEP

768:twW0thQE1QLIFgAAWjAV9V++MwG61OzhB1jy8n4Li:tz0vQEmPAncV9FMwhOzh3G8n4e

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1460-55-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe

pid process

1460 e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe

pid	process
1460	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe

description	pid	process	target process
PID 1460 wrote to memory of 316	1460	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe	cmd.exe
PID 1460 wrote to memory of 316	1460	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe	cmd.exe
PID 1460 wrote to memory of 316	1460	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe	cmd.exe
PID 1460 wrote to memory of 316	1460	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe	cmd.exe

memory/316-56-0x0000000000000000-mapping.dmp

Download
memory/1460-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1460-55-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download