83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0

Analysis

max time kernel
148s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:19

Target

83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0.exe
Size

134KB
MD5

38313c4ace818a2bae090e99d5241254
SHA1

e7b60faf249a9a1bf866a39f8583e071f533ebe5
SHA256

83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0
SHA512

529253c372b55c58424cecc879bdbe910c7bf72c8b0faddcdb014c56c4f661f01beaed98dd47afbe374ae1136506d8e16e44c61c875e7b29eff4fce6e6b447ec
SSDEEP

3072:o+yesgKmBvbiMXL92aR90ymkNPmkVMCZ2G+UDU/L:o+BsgNh739/mkNP6w1DY

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2144-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2144-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2144-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2144-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2144-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 2144	4576	83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0.exe	86
PID 4576 wrote to memory of 2144	4576	83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0.exe	86
PID 4576 wrote to memory of 2144	4576	83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0.exe	86

C:\Users\Admin\AppData\Local\Temp\83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0.exe
"C:\Users\Admin\AppData\Local\Temp\83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\83ebdfe987df1e61e9297e7d24a7168a5d76073835e11fcc4b03ee139cef0ff0.exe
  ?
  2⤵
  PID:2144

memory/2144-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2144-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2144-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2144-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2144-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2144-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4576-138-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download