40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3

Analysis

max time kernel
245s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:33

Target

40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe
Size

70KB
MD5

f8e363075af79dc4724b50b0532125e2
SHA1

5b64be9472eee0bace6cf746d6f4bc0863fd5b3d
SHA256

40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3
SHA512

43e5d7c97b70e5a26d3f534aaf6ab63853f8ec573271ba85c15d9fa4bca9da0ad43731da16e6d7abd397c021fa0302fdd6b7d67046dd4a27f50e02056bb0872c
SSDEEP

1536:9vVTskg+K2bbYtvmWa7tbqr/bETjSFM5PDcdns/A:TWn2bMa5bM/bETsGrys/A

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3056-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3056-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3056-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3056-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3056-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3056	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 3056	320	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe	80
PID 320 wrote to memory of 3056	320	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe	80
PID 320 wrote to memory of 3056	320	40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe	80

C:\Users\Admin\AppData\Local\Temp\40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe
"C:\Users\Admin\AppData\Local\Temp\40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:320
- C:\Users\Admin\AppData\Local\Temp\40a1e5b1e21677e9fabbff0ebad6b384be445a525d20d67dbe9dfba2c6df81e3.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3056

memory/320-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/320-134-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/3056-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3056-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3056-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3056-140-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/3056-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3056-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download