0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 11:28

Target

0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1.exe
Size

2.7MB
MD5

076136a3f89bbd23e479658a7a50643b
SHA1

90c5c1cbb08d8557c912793056a585e1bc37cf21
SHA256

0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1
SHA512

89139e648d0d2afec5b6daab1dcbfdef2d49d2f46123b258744998818ee34e3f511e202357d3e4bdd2f075b87d1f5ae1137c9190108655f5e64f53b22a89eca7
SSDEEP

49152:KjCFWNoJRLpXBWlfx2TD8JdEcHiw56+AqFwy+D+0ILG4UaujJxZ4cGxGlAq2l:KsWqRLpfD8JdDpf+cUaUxaXxGlb2l

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1912-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1912-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1912-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1912-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1912-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1912	2920	0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1.exe	80
PID 2920 wrote to memory of 1912	2920	0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1.exe	80
PID 2920 wrote to memory of 1912	2920	0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1.exe	80

C:\Users\Admin\AppData\Local\Temp\0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1.exe
"C:\Users\Admin\AppData\Local\Temp\0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Users\Admin\AppData\Local\Temp\0cdd1196d68711477a32f2f68880fb8263425b6aa4159c51753ea999c6ecd7a1.exe
  ?
  2⤵
  PID:1912

memory/1912-133-0x0000000000000000-mapping.dmp

Download
memory/1912-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1912-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1912-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1912-141-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/1912-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1912-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2920-132-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/2920-134-0x0000000000400000-0x00000000006B6000-memory.dmp

Filesize
2.7MB

Download
memory/2920-135-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download