47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb

Analysis

max time kernel
152s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 10:25

Target

47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe
Size

130KB
MD5

50c3bd2393d4eadbe9547648fde84afa
SHA1

0172e45032eb44a837027c32dc31661a912a4cf7
SHA256

47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb
SHA512

9c8f8a2b90025c15917454dc6264bbf3e774a301d3318bf07f54794a0dd21745e177903e2e083508e1f278688f00a11994bc1aecc026b7ae5816ef8e12cbf270
SSDEEP

3072:XTG1QgbTxHHIsBHKGXCbOqjsXb8eedXWp/e:XTG1H3tIwqGXCLX

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1268-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1268-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1268-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1268-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1268	1368	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe	84
PID 1368 wrote to memory of 1268	1368	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe	84
PID 1368 wrote to memory of 1268	1368	47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe	84

C:\Users\Admin\AppData\Local\Temp\47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe
"C:\Users\Admin\AppData\Local\Temp\47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\47ceb2c80ec61a5187760a3e7edc4153825d54218a9525ad97a4f41ed7e5e5bb.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1268

memory/1268-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1268-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1268-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1268-139-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1268-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-133-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download