474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 10:25

Target

474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe
Size

80KB
MD5

bb0f26566a828dabdc56d4e9eacff668
SHA1

035326d2946380b3d05914f4ff49a6743da92c94
SHA256

474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90
SHA512

7305b8699003a13bf6d857fcbfee29272b193e0a258b42589a71a6da48cb1b87919197795b7eb27014ff53f65847a9355ce86d429efddb892ae6a4332075fea8
SSDEEP

1536:zuLUm5kpc1FTLN8kGsBYE+VhRbG3YgJN2t979MmM5RNMEhdSYUiksns/w:iLtkcnB8kGs2E0RBgT23B5M9HMss/w

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/604-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/604-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/604-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/604-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/604-68-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
604	474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 604	2044	474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe	26
PID 2044 wrote to memory of 604	2044	474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe	26
PID 2044 wrote to memory of 604	2044	474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe	26
PID 2044 wrote to memory of 604	2044	474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe	26

C:\Users\Admin\AppData\Local\Temp\474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe
"C:\Users\Admin\AppData\Local\Temp\474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\474c4d76e6202635ca99e9e222d86565b259e0f0bfd14afd1ed20c1de8fe3c90.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:604

memory/604-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/604-58-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/604-59-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/604-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/604-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/604-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/604-54-0x0000000000000000-mapping.dmp

Download
memory/604-67-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/604-68-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2044-56-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2044-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2044-57-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download
memory/2044-66-0x0000000000200000-0x0000000000215000-memory.dmp

Filesize
84KB

Download