cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4

Analysis

max time kernel
179s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:58

Target

cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4.exe
Size

141KB
MD5

c3c4ff8726b9c276d88c23c1f3d11b5b
SHA1

271fb01a93cecf0c04d96041fd95fba2f048861e
SHA256

cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4
SHA512

e1e8f7c1a08599b6e74a8fc8e7f32f847259bb33978145d2fe497ba1e938396d2abe9405f5fe39b838fb5380124965b0b77f825ca358298a8d959c42fb5eaf0f
SSDEEP

3072:LQpX3xS1dvaQHOjumvtWyfz7FvvL4rnI0wEP/Z:eUXyQAumFWyV2I/EZ

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1004-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1004-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1004-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1004-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1004-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1004	1268	cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4.exe	79
PID 1268 wrote to memory of 1004	1268	cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4.exe	79
PID 1268 wrote to memory of 1004	1268	cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4.exe	79

C:\Users\Admin\AppData\Local\Temp\cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4.exe
"C:\Users\Admin\AppData\Local\Temp\cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\cf7775664c45699afe8f0fe618054c5bf9dd9065175fbb44cb177dc96f0473c4.exe
  ?
  2⤵
  PID:1004

memory/1004-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1004-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1004-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1004-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1004-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1004-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1268-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download