6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351

Analysis

max time kernel
69s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:41

Target

6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe
Size

133KB
MD5

85cc355344a2c7a8c987cb8ccc530fa0
SHA1

a941a625f167d12deadb73471e9473b25760d702
SHA256

6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351
SHA512

aa0b8dcb9c859c6eecb018b7aa1af1a80dc91f196eb109b36da3ee65869a8adca66306ab7bd37e685662740a663b1abe214b06f8d19e13441ca5e6908cfb2373
SSDEEP

3072:MV3poWDX2sSqoa8coZ/PhXYoifphYSoA0Gbhbhi/qiXWW/D:eX1SqoZc+PwDY5A0Gbvi/qy

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4288-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4288-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4288-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4288-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4288-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4288	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4288	3736	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe	82
PID 3736 wrote to memory of 4288	3736	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe	82
PID 3736 wrote to memory of 4288	3736	6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe	82

C:\Users\Admin\AppData\Local\Temp\6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe
"C:\Users\Admin\AppData\Local\Temp\6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\6fe1be61f123d3eb5ced21ce6579ee4ed9c10ffadacb903dd5dbe5714be58351.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4288

memory/3736-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4288-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4288-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4288-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4288-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4288-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4288-141-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4288-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download