036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:38

Target

036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe
Size

132KB
MD5

789e64a3a9d6bf4c0c4af145e648682f
SHA1

49ad5462db68861fb259163e7193da70b5b10b7e
SHA256

036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe
SHA512

e5fb39c522e9b023ef646a02a966367d0842453f0a173e823ea299f079bd59dd317f324b630f492126916e8a9afe73fade37c3fb508bdf09c9fda1edffa3f989
SSDEEP

3072:XwBixn6fQcyGuoRfHTuHl2gaL7DKONgc4/p96QwNGUDO/a:gBixnIQcyGu+vTSOzHDX

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1368-57-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1368-60-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1368-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/1368-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1368	1788	036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe	28
PID 1788 wrote to memory of 1368	1788	036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe	28
PID 1788 wrote to memory of 1368	1788	036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe	28
PID 1788 wrote to memory of 1368	1788	036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe	28

C:\Users\Admin\AppData\Local\Temp\036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe
"C:\Users\Admin\AppData\Local\Temp\036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\036add5d526738a0be130f1014a5a4eb04ea110b1d98ade513d782dd5b392cbe.exe
  ?
  2⤵
  PID:1368

memory/1368-57-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-56-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1368-60-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1368-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1368-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1788-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download