4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea

Analysis

max time kernel
39s
max time network
72s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:21

Target

4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe
Size

62KB
MD5

fdebc8875b178e8ef2032d9fd1a08cf9
SHA1

6c1ba34e26ef4f16551b18a4a1f108fb72595b19
SHA256

4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea
SHA512

a7f564858e0680bf7785f777c8bb1073e86da7dce91de921c47075886cb8429d989ceacb1ccc029d01daec8a3dc06f533f63d7eee95e70572df343dfe531b2c0
SSDEEP

1536:bvVTskgo04tp3gswKrpkSV04hbr6M6Vs/5:1Wo0yrG9eWy/5

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2004-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2004-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2004-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2004-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2004-67-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2004	2000	4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe	27
PID 2000 wrote to memory of 2004	2000	4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe	27
PID 2000 wrote to memory of 2004	2000	4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe	27
PID 2000 wrote to memory of 2004	2000	4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe	27

C:\Users\Admin\AppData\Local\Temp\4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe
"C:\Users\Admin\AppData\Local\Temp\4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\4ba3296512a709f960e75f06610ae7e382eb76208682f9e7a92c46661ff6acea.exe
  ?
  2⤵
  PID:2004

memory/2000-55-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2000-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2000-59-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2004-58-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2004-57-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/2004-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2004-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2004-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2004-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2004-66-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2004-67-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download