5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:01

Target

5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe
Size

129KB
MD5

f4af88d6a81ff930cac494f66a9f114e
SHA1

314114ffd9f712fa973a12cae631e86db81c95b8
SHA256

5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa
SHA512

487c7b4b4a3d848e8314dd189c2831eb2f81cb9aa2d19f56a367923b99168a41c142795166f8803f24145ec2b2ccfc1b98765cc22b931962caa7fd977c4c05d4
SSDEEP

1536:gu4H+FKtPBwimFbeCZ0Vj8+7KFFBnMdi6VEp/KFF4C0hwKDPMzs1hfrXncUdNFsP:eLkFFbeCZ0V1mp2i6X0h/RhfrsUDi/H

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1772-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1772-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1772-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1772-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1772	1584	5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe	26
PID 1584 wrote to memory of 1772	1584	5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe	26
PID 1584 wrote to memory of 1772	1584	5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe	26
PID 1584 wrote to memory of 1772	1584	5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe	26

C:\Users\Admin\AppData\Local\Temp\5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe
"C:\Users\Admin\AppData\Local\Temp\5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe
  ?
  2⤵
  PID:1772

memory/1584-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1584-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1772-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1772-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1772-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1772-63-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1772-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download