45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1

Analysis

max time kernel
187s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:27

Target

45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe
Size

133KB
MD5

dc61422ff642b5aec8e120be46901571
SHA1

cc766ef570e174254c79d130f42b1fee38069905
SHA256

45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1
SHA512

05994239a66d74684744429cc250baee2a25f2b462ac4a4d921a61c0c3e3806003b5f72194f4d5fc2aa105e16f91aff43353d8be68650aaf8b26602f1cfe5279
SSDEEP

3072:kV3po0fkHg+p3018qaZ+ifphYSoA0GbhbhikqiUDA/w:mkHg+pE1YxDY5A0Gbvikq/DT

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2204-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2204-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2204-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2204-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/2204-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2204	45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2204	4760	45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe	79
PID 4760 wrote to memory of 2204	4760	45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe	79
PID 4760 wrote to memory of 2204	4760	45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe	79

C:\Users\Admin\AppData\Local\Temp\45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe
"C:\Users\Admin\AppData\Local\Temp\45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\45b7ad2fe7d77250c415b4c9263e0c8ac1dc7b7c791e02bfe7e3c42a862faac1.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2204

memory/2204-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2204-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2204-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2204-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2204-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2204-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4760-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4760-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download