cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:58

Target

cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5.exe
Size

130KB
MD5

e61754b94f1bfcc3e2b3f5e8abad6a0f
SHA1

b415aeb5781cf8e05af86d4d22382335be11775e
SHA256

cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5
SHA512

8d5abcd3998ab27711fe347ec7e2133b280864c4eece9c8c9ad8693f0dbbdb2bf614627d1fc69e17c1bd15d8bca10ca69534e039f70224a382d538aad9781ecc
SSDEEP

3072:xTG1QgycWDKIWMPhdBM3CbOqjsXb8esdXW3/Gd:xTG1HycjIxTBM3Cpld

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3128-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3128-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3128-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3128-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3128-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3128	4816	cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5.exe	81
PID 4816 wrote to memory of 3128	4816	cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5.exe	81
PID 4816 wrote to memory of 3128	4816	cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5.exe	81

C:\Users\Admin\AppData\Local\Temp\cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5.exe
"C:\Users\Admin\AppData\Local\Temp\cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\cf6693d925338a621fbb1cbfa2b440075621e825a9774fcaec9614a7b8bbd1d5.exe
  ?
  2⤵
  PID:3128

memory/3128-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3128-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3128-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3128-139-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3128-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3128-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4816-133-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download