5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932

Analysis

max time kernel
247s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:01

Target

5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe
Size

126KB
MD5

ec6d1c51362b400c9c7882717b369a69
SHA1

2971edeb900ab97138f92839728d670c8887cb22
SHA256

5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932
SHA512

11f9c455ab63382883bf62bac9990a20934f8524dda8ffd0d8044e4f8205506a456fdf3ae66d60dc34b5bc6fede01d890a98235ef90f668c17fb153e4b899e85
SSDEEP

3072:8JYHCCWXV2JO7KQno2ecJGjQX94a/qZXWY/8:JHFIKoo2ec0Y94a/l

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1520-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1520-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1520-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1520-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1520	288	5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe	28
PID 288 wrote to memory of 1520	288	5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe	28
PID 288 wrote to memory of 1520	288	5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe	28
PID 288 wrote to memory of 1520	288	5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe	28

C:\Users\Admin\AppData\Local\Temp\5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe
"C:\Users\Admin\AppData\Local\Temp\5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Local\Temp\5d789585ddc732f247679f4c7739746fa6f848f43f2272826750789e2d670932.exe
  ?
  2⤵
  PID:1520

memory/288-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1520-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1520-57-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1520-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1520-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1520-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1520-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1520-64-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download