2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c

Analysis

max time kernel
52s
max time network
76s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:53

Target

2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe
Size

133KB
MD5

56baf65beffb8c77083337dd9cb6b612
SHA1

3a84f71e6228eeb20e069f84f585605b465eef86
SHA256

2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c
SHA512

9bd3955b2a6c16a4c0ab0b56ff87bff86afdb5f51b48ad2479e85466e671748181ace43fd9312d452e34511408a0d61e1baa8788ac6b6ffbb1f6829c1f9350ad
SSDEEP

3072:RV3pofIU3aTC64H3tXff3N781rCLoifphYSoA0GbhbhiFqiUDjt/X:/U3ajy3tXffBDDY5A0GbviFq/DN

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2040-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2040-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2040-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2040	1788	2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe	28
PID 1788 wrote to memory of 2040	1788	2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe	28
PID 1788 wrote to memory of 2040	1788	2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe	28
PID 1788 wrote to memory of 2040	1788	2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe	28

C:\Users\Admin\AppData\Local\Temp\2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe
"C:\Users\Admin\AppData\Local\Temp\2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\2cd61e370584a9aec3cfe882e1073fd33d4557ed78bd56cfa981792e5f51a28c.exe
  ?
  2⤵
  PID:2040

memory/1788-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2040-56-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/2040-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2040-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2040-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download