cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d

Analysis

max time kernel
176s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 15:16

Target

cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d.exe
Size

44KB
MD5

8f9837f81a9121c3650912c2bde95b70
SHA1

d3dd3db1fca0f3e1b7f37c391654a91ee814173d
SHA256

cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d
SHA512

a26d50210ed076230344f78b7dcbd59ba133ceef7af5ff20851c765087d35e31194d02d443b1771ea11f637e1b3d3d8eb839ac45436d8b59d3ec2e88d0bfec6e
SSDEEP

768:vsExfpdfBKaj2qIjzAgpCag52O8OsLTdyJh2StR:vsgfrBLqrjzZd+2OqwJhB

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4112-132-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral2/memory/4112-135-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4084	4112	cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d.exe	81
PID 4112 wrote to memory of 4084	4112	cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d.exe	81
PID 4112 wrote to memory of 4084	4112	cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d.exe	81

C:\Users\Admin\AppData\Local\Temp\cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d.exe
"C:\Users\Admin\AppData\Local\Temp\cc1cf6714307049f16067e5ba8cb1578df9afd0899f1bae3ba19d4054b24422d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W2I_JVS.bat""
  2⤵
  PID:4084

C:\Users\Admin\AppData\Local\Temp\W2I_JVS.bat

Filesize
3KB

MD5
66e513ed82835bc1829352d419ca0552

SHA1
66e8cc5ef3a47b1707b10531c86e768e45e6545a

SHA256
da5276b1c29b932c97758ee2ac3fa64fd204d5e5e4f7496d72ac46d728a7da10

SHA512
84eab9180a700e61c6176eccbf72477aedbfbafe33b2c5a5b1ce872d3c59363185fb003af08e0c43751661f9304c6152fc902c5e36686c99e191010009a87c33

Download Submit
memory/4112-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4112-135-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download