10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0

Analysis

max time kernel
179s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 11:23

Target

10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0.exe
Size

133KB
MD5

8c35c38a1a4d15bde96a90a7023bfbc1
SHA1

7721bba0de451cb282717d6b81345e88fa5e7dff
SHA256

10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0
SHA512

904e5957b6c84b20f6552d460cd97e9aa842a410d527752c6c536432a1624bf7a3883a23e6bcd03acd70c99586a71766ce1f06c1b4fdd4197592ff2566e4e635
SSDEEP

3072:jV3pod0J3RxHK97PS0ifphYSoA0GbhbhiZqiUD2/D:7ZRxHggDY5A0GbviZq/DO

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3076-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3076-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3076-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3076-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3076	3196	10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0.exe	81
PID 3196 wrote to memory of 3076	3196	10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0.exe	81
PID 3196 wrote to memory of 3076	3196	10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0.exe	81

C:\Users\Admin\AppData\Local\Temp\10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0.exe
"C:\Users\Admin\AppData\Local\Temp\10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\10c232a2b83bf5dba4fce2fbb7d92f50514c62439c3d74a8467545d115fe9ce0.exe
  ?
  2⤵
  PID:3076

memory/3076-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3076-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3076-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3076-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3076-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3196-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download