9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa

Analysis

max time kernel
152s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 06:23

Target

9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe
Size

558KB
MD5

afdeaac2af2cde1e37630e8fae7a5604
SHA1

290dfbbe4ae29e029c9e58a004bf7da33f649e65
SHA256

9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa
SHA512

9bc1a08ebfd31c99c02d4260768aac51f4a6d4940609890481a60f15ed3ac40cb1f75b849f36122fc3bb61aa72de0a5f5c802237aa179e7b4ad93412a7c2c983
SSDEEP

12288:nuHLR0OqCDBdJAnkIMhEUV2vi1BoaIWFksafEx6WWfq2ZAOwbfqBuYCRc8:nuHLR0O9Db+nqEW2vYocWjfEDaq29vU

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/396-133-0x00007FF657E30000-0x00007FF657FB0000-memory.dmp	upx
behavioral2/memory/396-145-0x00007FF657E30000-0x00007FF657FB0000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4308	396	9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe	80
PID 396 wrote to memory of 4308	396	9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe	80

C:\Users\Admin\AppData\Local\Temp\9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe
"C:\Users\Admin\AppData\Local\Temp\9d8baac02265e0d1f00bed57cb1fa751c2261194466983ed14bb3b4f9f91a7aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\ProgramData\Oracle\Java\javapath\java.exe
  "C:\ProgramData\Oracle\Java\javapath\java.exe" -version
  2⤵
  PID:4308

memory/396-133-0x00007FF657E30000-0x00007FF657FB0000-memory.dmp

Filesize
1.5MB

Download
memory/396-145-0x00007FF657E30000-0x00007FF657FB0000-memory.dmp

Filesize
1.5MB

Download
memory/4308-144-0x0000000003010000-0x0000000004010000-memory.dmp

Filesize
16.0MB

Download
memory/4308-146-0x0000000003010000-0x0000000004010000-memory.dmp

Filesize
16.0MB

Download