06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d

Analysis

max time kernel
151s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:34

Target

06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d.exe
Size

130KB
MD5

c41e5dc29e6fc53f5164385f28197653
SHA1

d92926583feffb72684a8e723774f98ed974a38c
SHA256

06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d
SHA512

e55449eb08a8f72cc5eb31f56e36f0001e7251a5dc2f3a1bce81bb1fce4d76e660bd0a5b79f48603506ce94a63a920e8c17464d2681baabf4b2509ca4f228038
SSDEEP

1536:SkzuOBT8Ydsem1QnO8+EiFjYB8YCwIrZclWgDIOaBGRGG00CnbOBIjAlBA4b8eKt:1TG1QglnFZzgMk3CbOqjsXb8eudXWv/8

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1440-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1440-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1440-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1440-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1440-142-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1440	1656	06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d.exe	81
PID 1656 wrote to memory of 1440	1656	06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d.exe	81
PID 1656 wrote to memory of 1440	1656	06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d.exe	81

C:\Users\Admin\AppData\Local\Temp\06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d.exe
"C:\Users\Admin\AppData\Local\Temp\06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\06f415f6e05c49cf6fe4afc6f64991747ee3ab187a6ceffc643e1182d7f0973d.exe
  ?
  2⤵
  PID:1440

memory/1440-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1440-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1440-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1440-140-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1440-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1440-142-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1656-134-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download