2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 20:31

Target

2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe
Size

127KB
MD5

2cb44900c8db3ead454305b2c9040b53
SHA1

5160012d8122c1b0dbc6b74887783730643274b7
SHA256

2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b
SHA512

79272aec8c195ac1632e5bde0e88b518b2ee79566ea7c9556cc244551c1d76b954afe2f3cb0cc9e7f32bd2680fc1537667e9848faa9e53c0214c3f29f9b6a851
SSDEEP

1536:vDEEJ/ndDzOKA0sn6lrHS/csdLN0wONfbMXjnq8aOQVpW4tkkQL/k/AhvVTskgJx:AEJxzi0V5HSUujMIzu5OKQLWAXWG/q

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/276-59-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/276-63-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/276-62-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/276-65-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 276	1672	2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe	28
PID 1672 wrote to memory of 276	1672	2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe	28
PID 1672 wrote to memory of 276	1672	2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe	28
PID 1672 wrote to memory of 276	1672	2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe	28

C:\Users\Admin\AppData\Local\Temp\2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe
"C:\Users\Admin\AppData\Local\Temp\2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe
  ?
  2⤵
  PID:276

memory/276-58-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/276-59-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/276-63-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/276-62-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/276-64-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/276-65-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1672-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download