24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228

Analysis

max time kernel
68s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:02

Target

24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228.exe
Size

130KB
MD5

97050b3a855c6c545c42873185ee2f50
SHA1

e476d9af4c76bc3ffdf232fb5c1efc808e7297ee
SHA256

24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228
SHA512

ce16c719dfa5abdcf04efe4d86ebea3262fc86725bc5c130f3033e1cc4022d8a64a3919ed5ea28df35d4421ae74854784c0054c141f5fda6ad64abd442a9844b
SSDEEP

3072:yTG1QgH3ZlxWQGQ4Vw8N0CbOqjsXb8eCdXWj/1:yTG1HXJTj4wQ0CLu

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1432-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1432-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1432-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1432-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1432-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1432	2364	24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228.exe	80
PID 2364 wrote to memory of 1432	2364	24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228.exe	80
PID 2364 wrote to memory of 1432	2364	24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228.exe	80

C:\Users\Admin\AppData\Local\Temp\24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228.exe
"C:\Users\Admin\AppData\Local\Temp\24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\24ed04bedad17858adc315d2a82e6dd23fdf39f5c037f286ff19082185637228.exe
  ?
  2⤵
  PID:1432

memory/1432-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1432-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1432-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1432-139-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1432-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1432-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2364-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download