752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:35

Target

752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe
Size

133KB
MD5

89aa6544c67b25aa5ce1c08da7a50b6c
SHA1

637117d70eb83cb0b3fab45e6409775879f70d98
SHA256

752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4
SHA512

36f9451157542b2c56853303d994a6be68d2e26fb2132eff0db64212b14d78c8029c8f6d9fe195eb97c694eceadc4f565ca585274c5ec6fe50fd7bc58eef1784
SSDEEP

3072:+V3po7LJyBnsrUoifphYSoA0GbhbhiyqiXW0/L:JcKyDY5A0GbviyqM

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4864-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4864-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4864-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4864-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4864	752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4864	4788	752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe	80
PID 4788 wrote to memory of 4864	4788	752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe	80
PID 4788 wrote to memory of 4864	4788	752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe	80

C:\Users\Admin\AppData\Local\Temp\752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe
"C:\Users\Admin\AppData\Local\Temp\752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\752d1c0c565f759ac7ef3ee0daf1866676e56d5c7c72efb37bb3edf94cf96ce4.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4864

memory/4788-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4864-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4864-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4864-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4864-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4864-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4864-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download