71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da

Analysis

max time kernel
178s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:38

Target

71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da.exe
Size

133KB
MD5

ad2ad1e229dbb783b6f9cc0169dd8f82
SHA1

f23d1a1f1f24e6618e74c34bcbeb5b87fe268e1b
SHA256

71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da
SHA512

d6d053d5781bbdb8243b260920363022b034d94143f1a6ad4c6950097515d7c33ec2eba4ecef501b7648d6d048ca85bb85a005afe98260adae8417b2ffcb7c6f
SSDEEP

1536:1ColPf55qQcJ81+DYx8ipeZDu/LnO759VxHx3bjHKvFghQWlxn7rxXLQy4ChYHHv:1wQU5mr/zSxRvKTWjn7N14ChyXWX/+

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/748-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/748-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/748-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/748-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 748	4644	71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da.exe	84
PID 4644 wrote to memory of 748	4644	71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da.exe	84
PID 4644 wrote to memory of 748	4644	71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da.exe	84

C:\Users\Admin\AppData\Local\Temp\71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da.exe
"C:\Users\Admin\AppData\Local\Temp\71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\71e9e2ec4efd88a96b1a7e9ff46c59d787e0d3edc9a4a724e4f76c578c25a5da.exe
  ?
  2⤵
  PID:748

memory/748-134-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/748-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/748-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/748-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/748-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/748-141-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4644-133-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download