6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22

Analysis

max time kernel
152s
max time network
154s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 03:56

Target

6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe
Size

84KB
MD5

0fef2e928510093ef5fae7a9dfc05e40
SHA1

0790b44d1d8e21a5a96b5f07eb1ed57db137da88
SHA256

6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22
SHA512

d53d0fcaaac722b8e53b4b9259e0577575e10cd729aca828748a686655d6bb3a7ce6a6125f5a40b5ca8d2fa89716ebbb005104dc89f542beced92ec6e554a023
SSDEEP

1536:f3SIYHAB/6kGXbHoyCMiHg3Pb5TxJ9TWYoXqsOmEs6wrAKfyGBt:fJYgOkyCG3dxJ9TWVXtBF5Dnn

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1816-55-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/memory/1816-61-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1284	1816	6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe	28
PID 1816 wrote to memory of 1284	1816	6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe	28
PID 1816 wrote to memory of 1284	1816	6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe	28
PID 1816 wrote to memory of 1284	1816	6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe	28
PID 1816 wrote to memory of 1284	1816	6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe	28
PID 1816 wrote to memory of 1284	1816	6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe	28
PID 1816 wrote to memory of 1284	1816	6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe	28

C:\Users\Admin\AppData\Local\Temp\6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe
"C:\Users\Admin\AppData\Local\Temp\6bdf547ac821cc61abdc91f97817c7b3ddd6a6dbb0c90888348ff3b099ccbb22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1284

memory/1284-57-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1284-59-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1284-63-0x0000000000BE0000-0x0000000000BE8000-memory.dmp

Filesize
32KB

Download
memory/1284-64-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1816-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1816-56-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1816-61-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1816-62-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download