9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa

Analysis

max time kernel
59s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 06:23

Target

9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe
Size

558KB
MD5

afdeaac2af2cde1e37630e8fae7a5604
SHA1

290dfbbe4ae29e029c9e58a004bf7da33f649e65
SHA256

9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa
SHA512

9bc1a08ebfd31c99c02d4260768aac51f4a6d4940609890481a60f15ed3ac40cb1f75b849f36122fc3bb61aa72de0a5f5c802237aa179e7b4ad93412a7c2c983
SSDEEP

12288:nuHLR0OqCDBdJAnkIMhEUV2vi1BoaIWFksafEx6WWfq2ZAOwbfqBuYCRc8:nuHLR0O9Db+nqEW2vYocWjfEDaq29vU

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/944-56-0x000000013F870000-0x000000013F9F0000-memory.dmp	upx
behavioral1/memory/944-68-0x000000013F870000-0x000000013F9F0000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 268	944	9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe	29
PID 944 wrote to memory of 268	944	9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe	29
PID 944 wrote to memory of 268	944	9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe	29

C:\Users\Admin\AppData\Local\Temp\9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe
"C:\Users\Admin\AppData\Local\Temp\9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\system32\java.exe
  "C:\Windows\system32\java.exe" -version
  2⤵
  PID:268

memory/268-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download
memory/268-61-0x0000000002190000-0x0000000005190000-memory.dmp

Filesize
48.0MB

Download
memory/944-56-0x000000013F870000-0x000000013F9F0000-memory.dmp

Filesize
1.5MB

Download
memory/944-68-0x000000013F870000-0x000000013F9F0000-memory.dmp

Filesize
1.5MB

Download