0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456

Analysis

max time kernel
112s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:26

Target

0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe
Size

134KB
MD5

352bc4ffca136f7515864e20060298d8
SHA1

6ca9447f1383f61291bae62baa7baa678bc172a4
SHA256

0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456
SHA512

f714dd3bcf2a40ebd0fef273fa5de791acd598c17dffab649bfafdf43c1375ab0aa44e5737c3bed051da7f20d0df82acf4a3a8a1b0b27468883425ef66ab15f6
SSDEEP

3072:Z+yTgq4RPPU4f17iTikNPraR90ymkNPmkVMCZbu+UDw/Y:Z+KgTP8497iukVC9/mkNP6wbODD

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1796-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1796-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1796-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1796-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1796-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 1796	2952	0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe	80
PID 2952 wrote to memory of 1796	2952	0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe	80
PID 2952 wrote to memory of 1796	2952	0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe	80

C:\Users\Admin\AppData\Local\Temp\0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe
"C:\Users\Admin\AppData\Local\Temp\0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\0e4c2c3a293904e4c3ddb9c5e1f4799429d7ccd9d35d8f1e9658ed8a4245b456.exe
  ?
  2⤵
  PID:1796

memory/1796-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1796-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1796-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1796-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1796-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1796-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2952-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download