d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36

Analysis

max time kernel
97s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:50

Target

d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe
Size

132KB
MD5

9c20b0d30dca5b77378a5f7fe1a83dcf
SHA1

d2c14dda9d07d3f87857d97a2b96ea209ce30bcc
SHA256

d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36
SHA512

d9422431f35e24659697b6bc264ffc877d75d1a6b337251392004d4d416c979f2e0bd32a29c17209b4f8e163caf5b6445e8ea6c4f41e467f3799b1b60dbc0b1f
SSDEEP

3072:DNBSAfznz+WoGWR5I+W5/LA2N5lOMURzPUDT/k:xBRbKDGW0J8rMUCDo

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4888-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4888-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4888-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4888-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4888-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4888	d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4888	4980	d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe	82
PID 4980 wrote to memory of 4888	4980	d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe	82
PID 4980 wrote to memory of 4888	4980	d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe	82

C:\Users\Admin\AppData\Local\Temp\d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe
"C:\Users\Admin\AppData\Local\Temp\d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\d63cff449a9a463755fa087e6843a11050360c59c0c0b0e4ab4bb8e9ae31af36.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4888

memory/4888-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4888-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4888-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4888-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4888-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4888-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4980-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download