85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4

Analysis

max time kernel
123s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:16

Target

85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4.exe
Size

2.8MB
MD5

7e6cbc37dbac90ae75b95f6ed7bf8b64
SHA1

d9a2bbdecebca08be0eb2c128565854dd3bea966
SHA256

85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4
SHA512

0a1646f36c852fb1b5513117007f45b66adfbf660670a4f068ca2611f7a4254b505e14c7bbb78767001c0de72da73fe58eb13f36fb278ff185501c9247bb5514
SSDEEP

49152:eypHbhu0UQIA92ZP5wz5lprL7j5XATOgTWb+TbkHikK8a+Qo0OZ/MvrQHl4c3vGe:XHbhu0UQfY55wz5lp75QTOXiTuikC+Qg

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5036-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5036-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5036-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5036-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5036-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 5036	5052	85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4.exe	83
PID 5052 wrote to memory of 5036	5052	85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4.exe	83
PID 5052 wrote to memory of 5036	5052	85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4.exe	83

C:\Users\Admin\AppData\Local\Temp\85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4.exe
"C:\Users\Admin\AppData\Local\Temp\85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\85c2dcb94c3768ffce5b9bb6ca70fec5ddd3023694d109793626c31cbe1d24f4.exe
  ?
  2⤵
  PID:5036

memory/5036-135-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/5036-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5036-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5036-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5036-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5036-142-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/5036-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5052-132-0x0000000000400000-0x00000000006C5000-memory.dmp

Filesize
2.8MB

Download
memory/5052-133-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download