6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351

Analysis

max time kernel
70s
max time network
82s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 09:41

Target

6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe
Size

133KB
MD5

85cc355344a2c7a8c987cb8ccc530fa0
SHA1

a941a625f167d12deadb73471e9473b25760d702
SHA256

6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351
SHA512

aa0b8dcb9c859c6eecb018b7aa1af1a80dc91f196eb109b36da3ee65869a8adca66306ab7bd37e685662740a663b1abe214b06f8d19e13441ca5e6908cfb2373
SSDEEP

3072:MV3poWDX2sSqoa8coZ/PhXYoifphYSoA0Gbhbhi/qiXWW/D:eX1SqoZc+PwDY5A0Gbvi/qy

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2036-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2036-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2036-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2036-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 2036	936	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe	28
PID 936 wrote to memory of 2036	936	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe	28
PID 936 wrote to memory of 2036	936	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe	28
PID 936 wrote to memory of 2036	936	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe	28

C:\Users\Admin\AppData\Local\Temp\6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe
"C:\Users\Admin\AppData\Local\Temp\6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2036

memory/936-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2036-56-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/2036-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2036-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2036-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2036-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2036-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download