acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 19:54

Target

acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe
Size

127KB
MD5

2589b996414888fc41a6629eb6fb5841
SHA1

5f88e512a865c0e773438c065c9683664ec03001
SHA256

acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10
SHA512

f9ac9ccd08aff6048f39678d6a69fbb516340ce1b9feaf5d851576be956623741be13f51fadc31b771305ed435715a821d250aee0be08de8a4416915c3bb8818
SSDEEP

1536:H7EEJ/ndDziZz1qS8jCFFJowrfGjoA05NNvONfbMXjnq8aOQVpW4tkkQLSk/Ahvg:wEJxziZ4BwiOT5vvMIzu5OKQL7AXWD/T

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4656-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4656-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4656-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4656-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/4656-144-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4656	4964	acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe	81
PID 4964 wrote to memory of 4656	4964	acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe	81
PID 4964 wrote to memory of 4656	4964	acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe	81

C:\Users\Admin\AppData\Local\Temp\acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe
"C:\Users\Admin\AppData\Local\Temp\acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\acfad4ae3d0916bf5e15a3f9a66771a04e8a09b6000995cac9868baf57ad7d10.exe
  ?
  2⤵
  PID:4656

memory/4656-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4656-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4656-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4656-142-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4656-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4656-144-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4964-136-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download