15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6

Analysis

max time kernel
169s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 15:47

Target

15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe
Size

195KB
MD5

3fbd340a73caa2e93eb037211db2e040
SHA1

7b26576ac480b0ce6c0c14d96f4e915e30c998ad
SHA256

15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6
SHA512

bb4e941f3513a8e54eef41064ca09c51223d5e42d6cc61d6d4395aa4cc4ce8494c3ab704331cfcff669107ac0633d48eab29620613b9be966fdcc30d4607c129
SSDEEP

3072:8vLhs8bbfuN0GzQZqaoH6uAzbYwIpTB2WIZLcjShZUFl7VI:8vLDs0GSkTAUwNWIZLcjSW7V

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1956-54-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1948	1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe	28
PID 1956 wrote to memory of 1948	1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe	28
PID 1956 wrote to memory of 1948	1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe	28
PID 1956 wrote to memory of 1948	1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe	28
PID 1956 wrote to memory of 1948	1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe	28
PID 1956 wrote to memory of 1948	1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe	28
PID 1956 wrote to memory of 1948	1956	15ca0ec11ec39661575f356ae17369b11c9ce189c283964eb2d1d9e6ff4829f6.exe	28

memory/1948-55-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1948-57-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1948-58-0x0000000000000000-mapping.dmp

Download
memory/1948-60-0x0000000000E60000-0x0000000000E68000-memory.dmp

Filesize
32KB

Download
memory/1948-61-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1956-54-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1956-59-0x0000000000290000-0x00000000002A4000-memory.dmp

Filesize
80KB

Download