ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052

Analysis

max time kernel
246s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:23

Target

ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe
Size

63KB
MD5

a2d80cda52cf4e2359320cec15e0aaa1
SHA1

a89f1f72b67226aec24cb1ae5e032a577342684e
SHA256

ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052
SHA512

b73e9fdec9ea4f3b4c003ec48b7b54b993a47b03d8f377afbe34c12521455d704c6a80d17d669815cd024082c03ddc5a0828ae67fa70424fb8f0c45e841e1f71
SSDEEP

1536:fvVTskgsqEu/IMYLsWYR8VM1IRsu92DvZCZKe/r77Ps/d:5WsqECIbYRcMmp92DvNO7A/d

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1476-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1476-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1476-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1476-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1476-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 1476	468	ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe	28
PID 468 wrote to memory of 1476	468	ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe	28
PID 468 wrote to memory of 1476	468	ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe	28
PID 468 wrote to memory of 1476	468	ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe	28

C:\Users\Admin\AppData\Local\Temp\ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe
"C:\Users\Admin\AppData\Local\Temp\ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe
  ?
  2⤵
  PID:1476

memory/468-55-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/468-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/1476-57-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1476-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1476-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1476-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1476-63-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/1476-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1476-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download