076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042

Analysis

max time kernel
123s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 11:34

Target

076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe
Size

140KB
MD5

e1d100b8947060e42224b880088e3cf8
SHA1

87ef117e8b47a63a537feefb0c90562efd4c925d
SHA256

076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042
SHA512

c6bc1473152fa25442aaa658d3e7057f8e476f087dcd9edb62bb3af8f5063e7e3b7902cb14b6bcd8c616af84a9b070b1180f53bdbe4aa62523f222afa2329de9
SSDEEP

3072:6UD4KNUHHcr2JqvWWMxqlqcIXXhQj+WDRKcmBNlwwEC/q:6UEKNUnKTWnBXWj1wcAEP

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1540-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1540-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1540-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1540-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1540-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1540	076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1540	3132	076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe	81
PID 3132 wrote to memory of 1540	3132	076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe	81
PID 3132 wrote to memory of 1540	3132	076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe	81

C:\Users\Admin\AppData\Local\Temp\076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe
"C:\Users\Admin\AppData\Local\Temp\076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\076667def3640e8bef76bd6fe558e724a013d5100e2bf65e6d47b89518051042.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1540

memory/1540-132-0x0000000000000000-mapping.dmp

Download
memory/1540-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1540-136-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1540-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1540-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1540-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1540-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3132-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download