6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d

Analysis

max time kernel
156s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 09:50

Target

6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d.exe
Size

119KB
MD5

f0e4ba8b1c11157b6e9ba1c390133dfc
SHA1

71fe3c8edb160ad0ab9259c581969f9e0a91eb02
SHA256

6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d
SHA512

6be1bb08ea117c647f3518dac1b5a4211f7f62882e2f92a55d8f26cea36f7dd2e336a76cd0bfd3da283e047dd1ac650f3318f1a1386b59dde81e714757cbf122
SSDEEP

3072:psQ6PiuO8dKWgGLTCwGfVIbhkyOOlIoRk5HrXW:5vuMk31GokV4kR

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5108-134-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral2/memory/5108-138-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral2/memory/5108-137-0x0000000010000000-0x0000000010010000-memory.dmp	upx
behavioral2/memory/5108-140-0x0000000010000000-0x0000000010010000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 5108	3460	6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d.exe	83
PID 3460 wrote to memory of 5108	3460	6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d.exe	83
PID 3460 wrote to memory of 5108	3460	6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d.exe	83

C:\Users\Admin\AppData\Local\Temp\6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d.exe
"C:\Users\Admin\AppData\Local\Temp\6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Temp\6883dd5c1f8390f00314e5d9e96d2ab6e178060e9bba194581ddb750616cf25d.exe
  ?
  2⤵
  PID:5108

memory/3460-133-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5108-132-0x0000000000000000-mapping.dmp

Download
memory/5108-134-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5108-138-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5108-137-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5108-139-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5108-140-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download