65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289

Analysis

max time kernel
374s
max time network
418s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:53

Target

65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289.exe
Size

72KB
MD5

90e29e16a5be83fc876dcb2f0ef66ab5
SHA1

dadfe2d1469a106c7dfd4f3c6cf0c3734705090a
SHA256

65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289
SHA512

3625963f31f8da5777823ad732504a7079cb141706687c44dbf1c835e8fb42c32f76ab06a1acc1e065c8efee4a8aeea226447623a0064da71b2c847d53f0c3f8
SSDEEP

1536:JuLUhFRdS7LkcxNd4hIZXqk+AJAxw7DWwSQSY7f6x9NNLGas/q:gLejS7txNd4hkJQCWpk6PNNLy/q

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2860-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2860-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2860-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2860-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2860-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2860	4920	65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289.exe	81
PID 4920 wrote to memory of 2860	4920	65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289.exe	81
PID 4920 wrote to memory of 2860	4920	65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289.exe	81

C:\Users\Admin\AppData\Local\Temp\65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289.exe
"C:\Users\Admin\AppData\Local\Temp\65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\65ca471c976ec03929f7ae8b63528b32dc2863c0b340cc76ab5f5db8996ba289.exe
  ?
  2⤵
  PID:2860

memory/2860-135-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2860-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2860-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2860-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2860-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2860-142-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2860-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4920-133-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4920-134-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download