aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 05:56

Target

aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888.exe
Size

92KB
MD5

dbc8388a99e6547388338a56b221fa38
SHA1

e6c4606a13a56df62da129cd3c4e181972c5d5b9
SHA256

aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888
SHA512

9aed85ba5cc64bed5f09087114b85b8f9270e5d6aa0a606787ad14d085f0be3865b68d1d9332d0f90571f696ba959ff36f43b7b7a5f16c4d7bb1ab8296f07534
SSDEEP

1536:jkgfroez/c0keqohis9YF3q4y7qtAbp8lnKZ/zzktQTJ+2O6NJGKU:Jf0ezDdqohGF3vyWWN8Rknw2O6XGKU

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4648-132-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/4648-135-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5048	4648	aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888.exe	79
PID 4648 wrote to memory of 5048	4648	aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888.exe	79
PID 4648 wrote to memory of 5048	4648	aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888.exe	79

C:\Users\Admin\AppData\Local\Temp\aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888.exe
"C:\Users\Admin\AppData\Local\Temp\aa22d1de7c562af8747fbae7af1f16dc9191a5dfa68c1fa60c2c8bc9b5676888.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\Untitled1.vbs"
  2⤵
  PID:5048

C:\Users\Admin\AppData\Local\Temp\Untitled1.vbs

Filesize
44KB

MD5
6f3db03bfa82b98efc3916aa3f0cbe70

SHA1
80435d5da65cda979d741dee770965e9f23b596b

SHA256
13a3a415aa86d9379b7e2b518d12bb9cac08c3766d6ed622bbe58d48dcd2f394

SHA512
0d51e123d763aa94b8d041a02e5f5d1af064a7d7985d21e19466fcefb3dc947590225b5060afa5d64daa4c9d7c0831ea37e369fa5912d6ae66c5ef6ae962cffa

Download Submit
memory/4648-132-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4648-135-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download