ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 08:38

Target

ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe
Size

133KB
MD5

1d0f74998990e5239a2b192ca495edad
SHA1

d4e15083d379f0badf1775f6aa59f61c139a8db9
SHA256

ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511
SHA512

c0fb4331b6f2d63f975e80bf739098bb81ad67c129d50b56c4e27b59f73bcfe19ad6270e8ba0e4d54a1121b411df08e429f41375a72b7c766dfee719561d4fc8
SSDEEP

3072:qV3pozOnmM6WknoifphYSoA0GbhbhiYqiXWW/t:MnmM6WwDY5A0GbviYq4

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1956-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1956-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1956-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1956-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1956	1404	ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe	28
PID 1404 wrote to memory of 1956	1404	ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe	28
PID 1404 wrote to memory of 1956	1404	ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe	28
PID 1404 wrote to memory of 1956	1404	ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe	28

C:\Users\Admin\AppData\Local\Temp\ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe
"C:\Users\Admin\AppData\Local\Temp\ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\ac16edddee6f7c0830539d88faed79065565092af76b9ecda35ee4c4cf7a4511.exe
  ?
  2⤵
  PID:1956

memory/1404-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1956-56-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1956-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1956-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1956-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1956-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1956-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download