3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838

Analysis

max time kernel
74s
max time network
98s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:47

Target

3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe
Size

138KB
MD5

09a140c93ae379b717cb1eb54e4944b5
SHA1

e7b28e982104a41a023b0d8f7f16c06273a07f00
SHA256

3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838
SHA512

50e57f0521a23aaa2c2c15191366c6e51f2daf38bf41a435f1e13e076ff83185f74899a01749969c7559f3b2866c269d9d360144ead6d3443210eb24244abfbf
SSDEEP

3072:YVD+01bp4ZE8Jh2F9LmJirrCzvPwQUDP/5:YVlpkE5FFmvzngD5

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1696-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1696-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1696-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1696-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1696	1744	3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe	28
PID 1744 wrote to memory of 1696	1744	3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe	28
PID 1744 wrote to memory of 1696	1744	3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe	28
PID 1744 wrote to memory of 1696	1744	3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe	28

C:\Users\Admin\AppData\Local\Temp\3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe
"C:\Users\Admin\AppData\Local\Temp\3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe
  ?
  2⤵
  PID:1696

memory/1696-56-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1696-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1696-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1696-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1696-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1696-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1744-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download