01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d

Analysis

max time kernel
167s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:40

Target

01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d.exe
Size

140KB
MD5

dcbdf7cd424b4a3e5b662f4bebd2faf0
SHA1

9f177932d6a9ecd21493374e19ef671a73617f54
SHA256

01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d
SHA512

db05208e34386ee4d279e0a519c6dbe904cf43596f143e3fc18fdc95cef9529a11f895ce7f54711571b6d4e0934f2fdaa156ab0b5cabe6244bb98ea0f805dc18
SSDEEP

3072:FUVW+2r8u033iFAmTWMxqlqcIXXhQj+WDRKc1BNlwwEO/G3:FUVIYnTgnBXWj1wc7EJ

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/396-134-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/396-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/396-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/396-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/396-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 396	3692	01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d.exe	79
PID 3692 wrote to memory of 396	3692	01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d.exe	79
PID 3692 wrote to memory of 396	3692	01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d.exe	79

C:\Users\Admin\AppData\Local\Temp\01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d.exe
"C:\Users\Admin\AppData\Local\Temp\01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Local\Temp\01d7d8af0cbbfa762c28628f789529a870a59e54f5b6e94ab5fe80a023417e0d.exe
  ?
  2⤵
  PID:396

memory/396-134-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/396-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/396-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/396-139-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/396-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/396-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3692-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download