522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:14

Target

522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286.exe
Size

134KB
MD5

4663301f0fcc4698dab0c0df6be92cb8
SHA1

899415fa20272bdac3e4d5138e0a5b1a33df87e6
SHA256

522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286
SHA512

329a1ffe53fb515ecd15d0efc868b3481a4371fbaedfb567b6097d2ccc8eb0574ba536ce429e85c75ab98796fc0ccb0d230555950e16f9c5d6c94313f7598ce6
SSDEEP

3072:ISSxT8VmtjLPAGFb4motAR4CiVXB6MGS0JhOUvwrhUN9P9/X:ISSxRtvPAGFsmDG367nDd

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2976-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2976-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2976-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2976-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2976-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2976	1140	522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286.exe	80
PID 1140 wrote to memory of 2976	1140	522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286.exe	80
PID 1140 wrote to memory of 2976	1140	522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286.exe	80

C:\Users\Admin\AppData\Local\Temp\522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286.exe
"C:\Users\Admin\AppData\Local\Temp\522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\522451c04f6c6bef0c84ed15546f9906c86ad97dc8a4301478d1435ff90a5286.exe
  ?
  2⤵
  PID:2976

memory/1140-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2976-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2976-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2976-137-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2976-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download