d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 07:46

Target

d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe
Size

136KB
MD5

05747f4295119ba68910ab39b9501430
SHA1

0070a067b2070c7fb17ef8706e7d1aaa9a8f6c23
SHA256

d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793
SHA512

9f9340815a5fb554bd04432e912a88d0c61b5d7957905bc32c8d194e1342f168c41950ef23140f1719927725554b106b06a9856563ad2556fb9cc3e534e2bcb7
SSDEEP

3072:+TG1Qg+jyeU+43ZU7zCbOqjsXb8e4I0JhOUvwrhUN9P7/d:+TG1H+jyHeC5lDJ

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/956-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/956-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/956-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/956-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 956	960	d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe	27
PID 960 wrote to memory of 956	960	d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe	27
PID 960 wrote to memory of 956	960	d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe	27
PID 960 wrote to memory of 956	960	d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe	27

C:\Users\Admin\AppData\Local\Temp\d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe
"C:\Users\Admin\AppData\Local\Temp\d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\d90df1a2dc5b212b7bd094e2cc6f0cf28552d73b87959dd19519f50ff8b71793.exe
  ?
  2⤵
  PID:956

memory/956-55-0x0000000000000000-mapping.dmp

Download
memory/956-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/956-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/956-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/956-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/956-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/960-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download