6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322

Analysis

max time kernel
94s
max time network
99s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 09:41

Target

6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe
Size

133KB
MD5

c6c97c62a5533d8f5671cd9603b922f3
SHA1

4f6d0bbcc21f2e57e48d1874e7c24952ecf6e495
SHA256

6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322
SHA512

924957bf4cd68a31f9225362d80b61b808cc25147c9a0b5cebc66e06c7eb729a19981ae02b4af732a4c4888afb0c142456a5b96d7882240a34f9297bdd73cd1f
SSDEEP

3072:LV3ponUoqkuv8FhCJfifphYSoA0Gbhbhi4QqiUD2/Pe:9oo0mcDY5A0Gbvi9q/DP

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1408-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1408-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1408-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1408-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1408	6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1408	1600	6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe	28
PID 1600 wrote to memory of 1408	1600	6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe	28
PID 1600 wrote to memory of 1408	1600	6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe	28
PID 1600 wrote to memory of 1408	1600	6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe	28

C:\Users\Admin\AppData\Local\Temp\6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe
"C:\Users\Admin\AppData\Local\Temp\6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\6f98e675b0cfa71d0c0295dc61c33a6c8f5d6e86ad57da3c0e62b99f563e2322.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1408

memory/1408-54-0x0000000000000000-mapping.dmp

Download
memory/1408-56-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1408-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1408-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1408-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1408-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1408-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1600-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download