53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba

Analysis

max time kernel
182s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 10:12

Target

53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba.exe
Size

140KB
MD5

0ea2f5083df47b142de3a6e3d418dcc2
SHA1

6871752c3bf06b0e814d22d7e79dbfd27938b9a2
SHA256

53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba
SHA512

dabd10a8df09e438597493c24f00732a3d584ef1dc5e3cc8fe1f86d6dff05c1f82fc908991a2101499bb10368df1f338e73c0046dfce73256ef2dc80075346db
SSDEEP

3072:mUZvpCkWMxqlqcIXXhQj+WDRKcWBNlwwEt/k:mUxEknBXWj1wcQEK

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2184-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2184-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2184-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2184-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2184-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2184	4652	53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba.exe	79
PID 4652 wrote to memory of 2184	4652	53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba.exe	79
PID 4652 wrote to memory of 2184	4652	53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba.exe	79

C:\Users\Admin\AppData\Local\Temp\53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba.exe
"C:\Users\Admin\AppData\Local\Temp\53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\53c88589c85d2c647c816f39e5f97729729a7837e3e5b1906b72717ec9b656ba.exe
  ?
  2⤵
  PID:2184

memory/2184-132-0x0000000000000000-mapping.dmp

Download
memory/2184-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2184-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2184-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2184-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2184-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2184-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4652-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download