3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93

Analysis

max time kernel
145s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:38

Target

3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe
Size

134KB
MD5

2eadb57198bc2590281fd4ed16eb7200
SHA1

748c7cea9c2159d7f942f2e79c2654f58689af9e
SHA256

3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93
SHA512

6cdd149b19270e17aa27696dc6422c2fceee0d3ca555275fac2d60bd751abeea8e4a25b4bf4326a40617ac59114e285713ad1e21e77cae23016484b7a3aa6bc1
SSDEEP

3072:q+yliHN+mq17/CkPaR90ymkNPmkVMCZ8+UDn/:q+Sytq17/e9/mkNP6wsD

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1656-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1656-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1656-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1656-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1656-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1656	3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1656	3288	3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe	80
PID 3288 wrote to memory of 1656	3288	3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe	80
PID 3288 wrote to memory of 1656	3288	3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe	80

C:\Users\Admin\AppData\Local\Temp\3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe
"C:\Users\Admin\AppData\Local\Temp\3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\3b91f3b88876bbf71b1718ac72603c5c6b4749c79ce24e36c3e400e09338bf93.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1656

memory/1656-134-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1656-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1656-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1656-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1656-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1656-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3288-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download