8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0

Analysis

max time kernel
179s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:12

Target

8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0.exe
Size

60KB
MD5

74bacd2312df4eefafdc5a6419bb8715
SHA1

c4e1a1275cb3a68c6385ba38048ed8eff6c9a468
SHA256

8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0
SHA512

b933959855de1765aace5cfa522fc1e9beb8692d96f9fc6580c77ad1986c1cc285157859addbbc9f3ef4fa4d12a9371db8a33152535a2904ba0ff7964c4d89a3
SSDEEP

1536:YvVTskgGSN8MO0CtlIruHzeoBIcKXapQs/T93:eWGSKr05ruHzeubKXE/TF

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2040-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2040-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2040-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2040-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2040-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2040	2896	8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0.exe	83
PID 2896 wrote to memory of 2040	2896	8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0.exe	83
PID 2896 wrote to memory of 2040	2896	8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0.exe	83

C:\Users\Admin\AppData\Local\Temp\8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0.exe
"C:\Users\Admin\AppData\Local\Temp\8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\8a9d3f85cda232c7fed48d8e59361d6247082f624116f45a79948e2ad469bff0.exe
  ?
  2⤵
  PID:2040

memory/2040-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-140-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2040-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2896-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2896-134-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download