f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 22:48

Target

f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
Size

28KB
MD5

35e489aa81204b1cb1d284fdad3f1ea0
SHA1

88a635e1a17ff2ea1b1d878d0dcf1d7bc632484b
SHA256

f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094
SHA512

fe912ebdc26fb65520eadc6e58a068fa2b8ff6ba18f01447d631cdf20f0b0fec71186c8719a3af7c025b278f2bd865eb3893fcb72fcfb1cc29c7b38499e7a78f
SSDEEP

768:FZGobYAN4TGm6ufqXo/7mssEknSJn4Lgq:FMoUoQEo3sjen4Eq

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/692-54-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/692-55-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
692	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
692	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
692	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
692	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
692	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
692	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
692	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe

C:\Users\Admin\AppData\Local\Temp\f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
"C:\Users\Admin\AppData\Local\Temp\f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:692

memory/692-54-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/692-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download