612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 09:58

Target

612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe
Size

78KB
MD5

c4f034ceda00b25824ebb89ece877fa2
SHA1

16d01b3f477a53e44b4383d18e4cb8bcee0d355c
SHA256

612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc
SHA512

f79814d75b35adc8f6d31bdce5a05fb8b62dcf314c7e2316aa94f1270cb19650b5e1d404d466198c24991279cda0b50bb174c2bf7639f3624b1aa497c44ea899
SSDEEP

1536:oWO4sN/RXpqE6jp3kGzbdBgJacPLs6OuCU9xRJXYo4H3Ahs/C:oTXpCqGHwP4wCoX3W3Ae/C

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2276-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2276-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2276-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2276-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2276-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2276	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 2276	3852	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe	80
PID 3852 wrote to memory of 2276	3852	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe	80
PID 3852 wrote to memory of 2276	3852	612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe	80

C:\Users\Admin\AppData\Local\Temp\612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe
"C:\Users\Admin\AppData\Local\Temp\612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\612b4914d9f77b50f581187579b8d3207b80c73b9c55acd93f2ebbd3f1f9b6bc.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2276

memory/2276-135-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2276-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2276-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2276-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2276-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2276-142-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2276-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3852-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3852-134-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download