acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6

Analysis

max time kernel
152s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:16

Target

acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe
Size

82KB
MD5

10138ca97ad3cf534ec590e7b3a3b28d
SHA1

a57f0facdd627c22b6732c47db239de908d0e644
SHA256

acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6
SHA512

c01b03d8c8cb3346c14b1ff36c89970b5f982a925076cb7772de0315369e23190100572f541e25301a666192b80609bf75aa8378acf5ca1542df82e0cc34d939
SSDEEP

1536:Vgxeuds8fTJPKrNSa11Gj+DemlE/qsSrNQbPIqAtmWjrrolHQ7qQ9mQ:2wuNg4+DGqsSrN+w/DjolHQ7R9mQ

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1896-58-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2000	1896	acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe	28
PID 1896 wrote to memory of 2000	1896	acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe	28
PID 1896 wrote to memory of 2000	1896	acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe	28
PID 1896 wrote to memory of 2000	1896	acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe	28
PID 1896 wrote to memory of 2000	1896	acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe	28
PID 1896 wrote to memory of 2000	1896	acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe	28
PID 1896 wrote to memory of 2000	1896	acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe	28

C:\Users\Admin\AppData\Local\Temp\acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe
"C:\Users\Admin\AppData\Local\Temp\acb33c2c0e6bd47c6df26728565211d67987f7b78bce8fee058b3fa40af16ed6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\decff6fe4ac499badbfcc582dae2bdba.bat
  2⤵
  PID:2000

C:\Users\Admin\AppData\Local\Temp\decff6fe4ac499badbfcc582dae2bdba.bat

Filesize
253B

MD5
ec1822f5899c6a0d03ce29aadad2c24e

SHA1
4e45b796f9e3077183f0ffc2ac7112459a119c6c

SHA256
cf578f3e1cd3dc2d091a2e24030d7b8b64148bcdeaf0b52e023aa32579ad2541

SHA512
2ca428bf6a8c8a4ef2b2f606aa886c58794f776fe2fb7aa2976547e10cd609ecc65c0d96ce3eba061eb4b8f6a9c2311e727f5e9719db86614ae8f8b6fac1cf81

Download Submit
memory/1896-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1896-58-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1896-59-0x0000000000230000-0x0000000000252000-memory.dmp

Filesize
136KB

Download