f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06

Analysis

max time kernel
45s
max time network
81s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 07:14

Target

f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe
Size

69KB
MD5

005aa192c4e1618b12b0b64dded80e59
SHA1

6e5537ace69d4499dc9e2e1c9d890fc4c15de3c5
SHA256

f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06
SHA512

348b2eb462b8b145e8f0f1e428c31016b0ba863cfc7f688e3a2cbc926e47840bf37bc2d686322b40a043c588262923f4edf4229e09f0a9d027ed7d17b2086492
SSDEEP

1536:vuLU/duaqeK1gPq11aiTRIgj/LVuVzS2s/h:2LYAReK8uzeC/h

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/884-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/884-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/884-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/884-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/884-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 884	1652	f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe	27
PID 1652 wrote to memory of 884	1652	f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe	27
PID 1652 wrote to memory of 884	1652	f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe	27
PID 1652 wrote to memory of 884	1652	f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe	27

C:\Users\Admin\AppData\Local\Temp\f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe
"C:\Users\Admin\AppData\Local\Temp\f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\f2f2d1a2080969d86351aca5ad834b615cc81265254ad09199363b179ef54e06.exe
  ?
  2⤵
  PID:884

memory/884-54-0x0000000000000000-mapping.dmp

Download
memory/884-57-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/884-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/884-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/884-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/884-63-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/884-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/884-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1652-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1652-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download