97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d

Analysis

max time kernel
145s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 08:58

Target

97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe
Size

133KB
MD5

664a2273afcb31a148b9903ec5ddbd2f
SHA1

74d596ec8aebced14b40874c0e8420d1027a9764
SHA256

97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d
SHA512

bbd13636e2b2fcc4c11b60910d4266c3efa199074e0ada668091d5b0d4cd10efafffa6bbe1c7ada7a00b73f8f9b0191db39525fab81e97618ff990b4b36da956
SSDEEP

3072:7V3poXyQRn5VSWCyLNifphYSoA0GbhbhicqiUD6/DS:2yGVCyLkDY5A0Gbvicq/Dj

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3944-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3944-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3944-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3944-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3944-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3944	97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3944	4604	97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe	83
PID 4604 wrote to memory of 3944	4604	97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe	83
PID 4604 wrote to memory of 3944	4604	97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe	83

C:\Users\Admin\AppData\Local\Temp\97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe
"C:\Users\Admin\AppData\Local\Temp\97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\97595db25a352d830a319c8c069d5477a3a752ce3e8589fa878fd1764945e94d.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3944

memory/3944-132-0x0000000000000000-mapping.dmp

Download
memory/3944-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3944-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3944-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3944-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3944-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3944-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4604-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download