ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:23

Target

ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe
Size

63KB
MD5

a2d80cda52cf4e2359320cec15e0aaa1
SHA1

a89f1f72b67226aec24cb1ae5e032a577342684e
SHA256

ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052
SHA512

b73e9fdec9ea4f3b4c003ec48b7b54b993a47b03d8f377afbe34c12521455d704c6a80d17d669815cd024082c03ddc5a0828ae67fa70424fb8f0c45e841e1f71
SSDEEP

1536:fvVTskgsqEu/IMYLsWYR8VM1IRsu92DvZCZKe/r77Ps/d:5WsqECIbYRcMmp92DvNO7A/d

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3252-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3252-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3252-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3252-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3252-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3252	3916	ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe	81
PID 3916 wrote to memory of 3252	3916	ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe	81
PID 3916 wrote to memory of 3252	3916	ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe	81

C:\Users\Admin\AppData\Local\Temp\ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe
"C:\Users\Admin\AppData\Local\Temp\ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\ec52366c8e27d41dc2f5f766ae4ca4c96b9b485cb84a18a20645c4363aa40052.exe
  ?
  2⤵
  PID:3252

memory/3252-135-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/3252-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3252-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3252-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3252-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3252-142-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/3252-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3916-133-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3916-134-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download