3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838

Analysis

max time kernel
181s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 10:47

Target

3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe
Size

138KB
MD5

09a140c93ae379b717cb1eb54e4944b5
SHA1

e7b28e982104a41a023b0d8f7f16c06273a07f00
SHA256

3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838
SHA512

50e57f0521a23aaa2c2c15191366c6e51f2daf38bf41a435f1e13e076ff83185f74899a01749969c7559f3b2866c269d9d360144ead6d3443210eb24244abfbf
SSDEEP

3072:YVD+01bp4ZE8Jh2F9LmJirrCzvPwQUDP/5:YVlpkE5FFmvzngD5

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5024-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5024-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5024-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/5024-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 5024	1136	3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe	80
PID 1136 wrote to memory of 5024	1136	3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe	80
PID 1136 wrote to memory of 5024	1136	3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe	80

C:\Users\Admin\AppData\Local\Temp\3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe
"C:\Users\Admin\AppData\Local\Temp\3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\3346cddbabe8afae507bf1c962b7ab1f33051bc6896f7023b7db2c28b1c86838.exe
  ?
  2⤵
  PID:5024

memory/1136-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5024-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5024-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5024-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/5024-139-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5024-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download