e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9

Analysis

max time kernel
205s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:36

Target

e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe
Size

124KB
MD5

1e38c75753d65c2f581acaa5d1eca196
SHA1

4cb2e6f34dbc68003f7c5dc3956bcbfcf841f095
SHA256

e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9
SHA512

8687a0d8aeea4f94cf09e75841826bb4878cab1d45cfc791ce12e914131889cc72d786e4340da947a06c10d9919e5c72290390364f18e594a11a9baa2276ffe9
SSDEEP

3072:2V9rbXDV7xMPebuHnhCInYGoZf7P7+Nm8XWc/Y:0VbXRSrHIInYB7SG

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3692-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3692-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3692-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3692-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3692	4524	e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe	81
PID 4524 wrote to memory of 3692	4524	e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe	81
PID 4524 wrote to memory of 3692	4524	e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe	81

C:\Users\Admin\AppData\Local\Temp\e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe
"C:\Users\Admin\AppData\Local\Temp\e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\e0a97c208a04a2e8166570c8a3553ca609917d265edf050dcaab7955628108f9.exe
  ?
  2⤵
  PID:3692

memory/3692-135-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3692-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3692-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3692-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3692-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4524-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4524-134-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download