e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4

Analysis

max time kernel
248s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:36

Target

e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe
Size

26KB
MD5

05a08225ab7c5e62983c9805c89d8d8a
SHA1

628c64ae6329bff90edec532c417bfce0f6501b6
SHA256

e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4
SHA512

adbe830054b7cb766b1fa3517f91ad0a3d365de94d8cea36d1c57f8daed46d4a0ed221887042a3eb0228d25706be7901e8718015b552f3af082e63589d129471
SSDEEP

768:twW0thQE1QLIFgAAWjAV9V++MwG61OzhB1jy8n4Li:tz0vQEmPAncV9FMwhOzh3G8n4e

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3752-132-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe

description	pid	process	target process
PID 3752 wrote to memory of 1628	3752	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe	cmd.exe
PID 3752 wrote to memory of 1628	3752	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe	cmd.exe
PID 3752 wrote to memory of 1628	3752	e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe
"C:\Users\Admin\AppData\Local\Temp\e498256d94a64ea7fa8f5cd6529efc8340a0a4ec59d109e1580ff26d6204f8e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3752

memory/1628-133-0x0000000000000000-mapping.dmp

Download
memory/3752-132-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download