9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf

Analysis

max time kernel
34s
max time network
39s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 08:50

Target

9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe
Size

133KB
MD5

c50fad1592b71af2d216b6c295bb3fd8
SHA1

4b6e1ceacbf67e1ef2ffefbd403b558d9c06c340
SHA256

9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf
SHA512

64ab201e38e77a8404e1da719a57b6e38a21de5730a97fdad9d107ffc533dfb151b89f96b37cb334e68ec7e9df4aa6e5331ad6c53b0c4fc2422d65893baef66a
SSDEEP

3072:7V3poAFSmfgbrAm2TooifphYSoA0GbhbhieqiXWWp/5:8dvkCDY5A0Gbvieqa3

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1960-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1960-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1960-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1960-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1960	836	9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe	27
PID 836 wrote to memory of 1960	836	9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe	27
PID 836 wrote to memory of 1960	836	9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe	27
PID 836 wrote to memory of 1960	836	9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe	27

C:\Users\Admin\AppData\Local\Temp\9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe
"C:\Users\Admin\AppData\Local\Temp\9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe
  ?
  2⤵
  PID:1960

memory/836-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1960-56-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1960-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1960-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1960-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1960-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1960-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download