5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa

Analysis

max time kernel
152s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:01

Target

5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe
Size

129KB
MD5

f4af88d6a81ff930cac494f66a9f114e
SHA1

314114ffd9f712fa973a12cae631e86db81c95b8
SHA256

5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa
SHA512

487c7b4b4a3d848e8314dd189c2831eb2f81cb9aa2d19f56a367923b99168a41c142795166f8803f24145ec2b2ccfc1b98765cc22b931962caa7fd977c4c05d4
SSDEEP

1536:gu4H+FKtPBwimFbeCZ0Vj8+7KFFBnMdi6VEp/KFF4C0hwKDPMzs1hfrXncUdNFsP:eLkFFbeCZ0V1mp2i6X0h/RhfrsUDi/H

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3348-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3348-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3348-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3348-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 3348	4424	5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe	81
PID 4424 wrote to memory of 3348	4424	5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe	81
PID 4424 wrote to memory of 3348	4424	5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe	81

C:\Users\Admin\AppData\Local\Temp\5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe
"C:\Users\Admin\AppData\Local\Temp\5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\5d73bb2afa3f18c22353dc44fbe63dbfddd6fef863d3f8ec8844acc0897b36aa.exe
  ?
  2⤵
  PID:3348

memory/3348-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3348-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3348-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3348-139-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3348-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4424-138-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download