1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e

Analysis

max time kernel
177s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:12

Target

1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe
Size

133KB
MD5

9c0479472ba6e732184a192ccd4f11b7
SHA1

55e9cab762a0d08150f1e7f02167b55aebb7fb6a
SHA256

1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e
SHA512

01be303a022401f2e49f6b3250cdf33d58d38b59b2481ad5af95729de677a4154074cdedfd46c1a0b9e531c4ef6cfc633b6b4bc23a9d43826a4a1ffcaace95eb
SSDEEP

3072:6V3poqXb6FCGmy01zMrAoifphYSoA0GbhbhiZqiXWW/O:sXbMaDY5A0GbviZqH

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4200-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4200-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4200-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4200-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4200-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4200	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 4200	1520	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe	80
PID 1520 wrote to memory of 4200	1520	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe	80
PID 1520 wrote to memory of 4200	1520	1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe	80

C:\Users\Admin\AppData\Local\Temp\1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe
"C:\Users\Admin\AppData\Local\Temp\1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\1b19bd689c697fafcd52eab3cbc43e85b98c3d2d7fe1d688c69f50dcff5bd95e.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4200

memory/1520-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4200-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4200-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4200-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4200-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4200-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4200-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download