0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456

Analysis

max time kernel
93s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:26

Target

0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe
Size

134KB
MD5

352bc4ffca136f7515864e20060298d8
SHA1

6ca9447f1383f61291bae62baa7baa678bc172a4
SHA256

0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456
SHA512

f714dd3bcf2a40ebd0fef273fa5de791acd598c17dffab649bfafdf43c1375ab0aa44e5737c3bed051da7f20d0df82acf4a3a8a1b0b27468883425ef66ab15f6
SSDEEP

3072:Z+yTgq4RPPU4f17iTikNPraR90ymkNPmkVMCZbu+UDw/Y:Z+KgTP8497iukVC9/mkNP6wbODD

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/336-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/336-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/336-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/336-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 336	1704	0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe	28
PID 1704 wrote to memory of 336	1704	0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe	28
PID 1704 wrote to memory of 336	1704	0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe	28
PID 1704 wrote to memory of 336	1704	0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe	28

C:\Users\Admin\AppData\Local\Temp\0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe
"C:\Users\Admin\AppData\Local\Temp\0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe
  ?
  2⤵
  PID:336

memory/336-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/336-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/336-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/336-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/336-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1704-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1704-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download