c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa

Analysis

max time kernel
187s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 08:07

Target

c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa.exe
Size

124KB
MD5

677395f75c8b86bc847c3588f566e32d
SHA1

8531a76d19f6f709c88e67c392f5ded4673f539e
SHA256

c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa
SHA512

d8c7544c481fd29cbf078192b85c084b760fdf03105928239ceaa0aca64caa4a4965567b7218a67ac1a132ea28c5e0796886eddca6d25e6acc3046b4963d9e1a
SSDEEP

3072:eVjdZ9ytw+lSV/La/FP2buHnhCInYGoZf7P7+F0m8XWq/C:c5Z8twYStLa/ZLHIInYB7Vy

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4856-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4856-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4856-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4856-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4856	3588	c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa.exe	82
PID 3588 wrote to memory of 4856	3588	c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa.exe	82
PID 3588 wrote to memory of 4856	3588	c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa.exe	82

C:\Users\Admin\AppData\Local\Temp\c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa.exe
"C:\Users\Admin\AppData\Local\Temp\c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Users\Admin\AppData\Local\Temp\c7fe3739e42967a0dee68953ceb933b92da8c5afc58d3b84939bc1e6e6ece2fa.exe
  ?
  2⤵
  PID:4856

memory/3588-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3588-134-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4856-135-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4856-136-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4856-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4856-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4856-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4856-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4856-143-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download