c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577

Analysis

max time kernel
186s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 08:08

Target

c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577.exe
Size

136KB
MD5

0f8eb7dd795d730282c4e2efc3eb5ea4
SHA1

2747206bfc48aa0e833e1b0bb8df7c843f054050
SHA256

c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577
SHA512

017b0a9d5a49211ad975da1f3f16b6b1fee71265432abde6616e223928cc49a91b8db21eaab0894e7179bbd4b2075177aaf1a3a97d47e1f562634d8ef1b38b11
SSDEEP

3072:zTG1QgwK+2H+CbOqjsXb8efI0JhOUvwrhUN9P6/Y:zTG1HfeCmlDJ

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5076-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5076-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5076-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5076-144-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5076-145-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 5076	1476	c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577.exe	79
PID 1476 wrote to memory of 5076	1476	c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577.exe	79
PID 1476 wrote to memory of 5076	1476	c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577.exe	79

C:\Users\Admin\AppData\Local\Temp\c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577.exe
"C:\Users\Admin\AppData\Local\Temp\c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\c79499711fbc1890e6842cd7826a48eb407450b6f28b59629c49574f56083577.exe
  ?
  2⤵
  PID:5076

memory/1476-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1476-137-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5076-136-0x0000000000000000-mapping.dmp

Download
memory/5076-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5076-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5076-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5076-143-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5076-144-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5076-145-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download