5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94

Analysis

max time kernel
180s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 10:03

Target

5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94.exe
Size

76KB
MD5

554c77353bcc21eb7c297ea9e8ff44ab
SHA1

0e17a3d45c7fffbc59464942f454a57feb6d5725
SHA256

5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94
SHA512

626c33fd04966a469779d940c482aa39ac8dc5ae15a7934c1fcabc000703a96638f7091a818c05dce3998fafa3d276c710a3223218318c924f1a49b7c022bcdb
SSDEEP

1536:1FeThQQ/3jE1Lq1oYUlrheDjwREvVTskgSKdYyESsPGCBi1s/2:ohQq3CLqelrUfu6WSKtESs+CBL/2

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/960-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/960-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/960-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/960-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/960-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 960	2376	5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94.exe	80
PID 2376 wrote to memory of 960	2376	5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94.exe	80
PID 2376 wrote to memory of 960	2376	5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94.exe	80

C:\Users\Admin\AppData\Local\Temp\5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94.exe
"C:\Users\Admin\AppData\Local\Temp\5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\5b30e227419d40e592612a09ea00e92cc08f543bc41ca6af796b838e15043b94.exe
  ?
  2⤵
  PID:960

memory/960-132-0x0000000000000000-mapping.dmp

Download
memory/960-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/960-138-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/960-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/960-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/960-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/960-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2376-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2376-134-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download