d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:08

Target

d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba.exe
Size

91KB
MD5

faf20b221d4fe9d7425204a736f01a9c
SHA1

b2f3f1d60bb6be152773680de7dfbbfcd2b2fb5d
SHA256

d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba
SHA512

47e38877d7137e09def5a470649e2187cb51dace75d4b10406bb5cf3f574eb6217aec86837bf7d0f28070a81638744792d88b6c7b157eae34329cc6f17960730
SSDEEP

1536:JRuwXtR94B1hAnCBVS2tMXScdHMG6rM/DLnJQu9NgVS7WPUL7:JEwxu1hlVS2SicZMGoYBoVAL

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4196-132-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4196	d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3468	4196	d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba.exe	82
PID 4196 wrote to memory of 3468	4196	d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba.exe	82
PID 4196 wrote to memory of 3468	4196	d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba.exe	82
PID 4196 wrote to memory of 3468	4196	d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba.exe	82
PID 4196 wrote to memory of 3468	4196	d26c0e33acb6666f7a3fbd09a5956a1bcc373d1a2a2acfcc772b68ab691cb8ba.exe	82

memory/4196-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4196-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download