6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4

Analysis

max time kernel
116s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:37

Target

6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4.exe
Size

241KB
MD5

77de990e74535e4cc04c4767305aa6c7
SHA1

0b27ebd938e347f2c7f52e99e3ae2820d91a4d92
SHA256

6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4
SHA512

1f8267711112bd8042a0cfb9789680e64c763062ec548749729478a90c8cc2de2b8a442376c5edfbaed564d3490dc4434c2831902e35aca844c60fad647fbbac
SSDEEP

6144:G0f6HFe9VmkI09eujOLvr0Lcj5DCWt+O6XM:G0Meh0uWQLcNCWtZ

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/832-55-0x0000000000400000-0x00000000004DE000-memory.dmp	upx
behavioral1/memory/832-56-0x0000000000400000-0x00000000004DE000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4.exe

pid process

832 6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4.exe

pid	process
832	6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4.exe

C:\Users\Admin\AppData\Local\Temp\6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4.exe
"C:\Users\Admin\AppData\Local\Temp\6a1f5e454f2a5fca2e913f12b6b8072685597094afe3dbc045b87f85e6057cc4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:832

memory/832-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/832-55-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/832-56-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download