3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:39

Target

3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6.exe
Size

74KB
MD5

d56ece1ba59812403a8f8b2261e0cc69
SHA1

9d69daa87225efa8d9fb2d6de24647205a005f8f
SHA256

3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6
SHA512

a39790887e228a8b514d8398910fd3e7a18b014b06d3cef15ae5483ceafb1bb45e3555fbafa8ca789d6bb6ec6cbecf6c230eccaebefe2be00fc53bae6baa2064
SSDEEP

1536:quLULjOjKc95BRY+VH0GorimquZa7l3Fks/j:lLwgKO5BRYXGPca7l3/j

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/840-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/840-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/840-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/840-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/840-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 840	5080	3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6.exe	81
PID 5080 wrote to memory of 840	5080	3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6.exe	81
PID 5080 wrote to memory of 840	5080	3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6.exe	81

C:\Users\Admin\AppData\Local\Temp\3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6.exe
"C:\Users\Admin\AppData\Local\Temp\3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\3a8793ac2e0fbdd4e51f55f624ded158143ba7490e22dee9d1221ebef2e5c2a6.exe
  ?
  2⤵
  PID:840

memory/840-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/840-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/840-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/840-140-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/840-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/840-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5080-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5080-134-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download