6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 09:44

Target

6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe
Size

132KB
MD5

839e00144a7c25b679edd676c630a2d3
SHA1

e3ea030413d4786c2bb251116c99db1ff549e1ae
SHA256

6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198
SHA512

bf1cb450f0f405ed129f45f291ed0c93bd35ab6dfb3b4a77b96672c7fba5d81b46d309fb2339c8237cdd6ecce30d40ee2e32caa8160cc537975be0d85c3ab798
SSDEEP

3072:jMBFp+JtKiGpfYI+W5/LA2N5lOMUfCzPXWm/r:IBFpgRGVnJ8rMUf+

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1940-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1940-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1940-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1940-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1940	6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1940	900	6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe	27
PID 900 wrote to memory of 1940	900	6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe	27
PID 900 wrote to memory of 1940	900	6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe	27
PID 900 wrote to memory of 1940	900	6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe	27

C:\Users\Admin\AppData\Local\Temp\6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe
"C:\Users\Admin\AppData\Local\Temp\6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\6d7e2720d68f8f641fb697bd260c152c74de196542238d5f14f816c16ca3f198.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1940

memory/900-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1940-56-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1940-57-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1940-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1940-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1940-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1940-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1940-64-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download