acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10

Analysis

max time kernel
81s
max time network
89s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 19:54

Target

acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe
Size

127KB
MD5

2589b996414888fc41a6629eb6fb5841
SHA1

5f88e512a865c0e773438c065c9683664ec03001
SHA256

acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10
SHA512

f9ac9ccd08aff6048f39678d6a69fbb516340ce1b9feaf5d851576be956623741be13f51fadc31b771305ed435715a821d250aee0be08de8a4416915c3bb8818
SSDEEP

1536:H7EEJ/ndDziZz1qS8jCFFJowrfGjoA05NNvONfbMXjnq8aOQVpW4tkkQLSk/Ahvg:wEJxziZ4BwiOT5vvMIzu5OKQL7AXWD/T

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/672-58-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/672-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/672-61-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/672-64-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 672	528	acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe	27
PID 528 wrote to memory of 672	528	acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe	27
PID 528 wrote to memory of 672	528	acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe	27
PID 528 wrote to memory of 672	528	acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe	27

C:\Users\Admin\AppData\Local\Temp\acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe
"C:\Users\Admin\AppData\Local\Temp\acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe
  ?
  2⤵
  PID:672

memory/528-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/528-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/672-58-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/672-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/672-61-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/672-63-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/672-64-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download