e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9

Analysis

max time kernel
64s
max time network
109s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 07:36

Target

e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe
Size

124KB
MD5

1e38c75753d65c2f581acaa5d1eca196
SHA1

4cb2e6f34dbc68003f7c5dc3956bcbfcf841f095
SHA256

e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9
SHA512

8687a0d8aeea4f94cf09e75841826bb4878cab1d45cfc791ce12e914131889cc72d786e4340da947a06c10d9919e5c72290390364f18e594a11a9baa2276ffe9
SSDEEP

3072:2V9rbXDV7xMPebuHnhCInYGoZf7P7+Nm8XWc/Y:0VbXRSrHIInYB7SG

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1308-59-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1308-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1308-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1308-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1308	848	e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe	28
PID 848 wrote to memory of 1308	848	e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe	28
PID 848 wrote to memory of 1308	848	e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe	28
PID 848 wrote to memory of 1308	848	e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe	28

C:\Users\Admin\AppData\Local\Temp\e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe
"C:\Users\Admin\AppData\Local\Temp\e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe
  ?
  2⤵
  PID:1308

memory/848-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/848-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1308-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1308-58-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1308-59-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1308-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1308-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1308-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1308-65-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download