d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354

Analysis

max time kernel
205s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 07:47

Target

d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe
Size

140KB
MD5

c8696fef89e912517396fa26adeb2c1e
SHA1

ecea0737325f112f9262b997c50c72a620ba3593
SHA256

d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354
SHA512

6c4c7ab11d4825a27a656daac755c29acc10d2f74290db0db77f90009a7e0a536d9aa873c0aa1719275f61ed3eca1f94d8a3f6eafb0ff1f5f6f218c90a035cc8
SSDEEP

3072:pUyAll+Px36fsHVDWMxqlqcIXXhQj+WDRKcgBNlwwES/Y:pUyAll+PR1DnBXWj1wcaEF

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1824-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1824-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1824-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1824-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1824	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1824	1388	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe	81
PID 1388 wrote to memory of 1824	1388	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe	81
PID 1388 wrote to memory of 1824	1388	d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe	81

C:\Users\Admin\AppData\Local\Temp\d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe
"C:\Users\Admin\AppData\Local\Temp\d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\d84f88b2b1ec9635ce75f7fe407db78c72a42a7b2b95689f7dc1f25c0b1a4354.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1824

memory/1388-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1824-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1824-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1824-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1824-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1824-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download