9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf

Analysis

max time kernel
169s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 08:50

Target

9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe
Size

133KB
MD5

c50fad1592b71af2d216b6c295bb3fd8
SHA1

4b6e1ceacbf67e1ef2ffefbd403b558d9c06c340
SHA256

9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf
SHA512

64ab201e38e77a8404e1da719a57b6e38a21de5730a97fdad9d107ffc533dfb151b89f96b37cb334e68ec7e9df4aa6e5331ad6c53b0c4fc2422d65893baef66a
SSDEEP

3072:7V3poAFSmfgbrAm2TooifphYSoA0GbhbhieqiXWWp/5:8dvkCDY5A0Gbvieqa3

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2052-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2052-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2052-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2052-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2052	1180	9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe	79
PID 1180 wrote to memory of 2052	1180	9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe	79
PID 1180 wrote to memory of 2052	1180	9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe	79

C:\Users\Admin\AppData\Local\Temp\9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe
"C:\Users\Admin\AppData\Local\Temp\9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\9f2eeacb8d64ba1891682979a64a28a93d38ea4995616f24f1a6c9ddf95f45cf.exe
  ?
  2⤵
  PID:2052

memory/1180-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2052-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2052-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2052-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2052-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2052-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download