2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:31

Target

2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe
Size

127KB
MD5

2cb44900c8db3ead454305b2c9040b53
SHA1

5160012d8122c1b0dbc6b74887783730643274b7
SHA256

2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b
SHA512

79272aec8c195ac1632e5bde0e88b518b2ee79566ea7c9556cc244551c1d76b954afe2f3cb0cc9e7f32bd2680fc1537667e9848faa9e53c0214c3f29f9b6a851
SSDEEP

1536:vDEEJ/ndDzOKA0sn6lrHS/csdLN0wONfbMXjnq8aOQVpW4tkkQL/k/AhvVTskgJx:AEJxzi0V5HSUujMIzu5OKQLWAXWG/q

Score

8^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1212-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1212-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1212-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/1212-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1212	2592	2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe	79
PID 2592 wrote to memory of 1212	2592	2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe	79
PID 2592 wrote to memory of 1212	2592	2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe	79

C:\Users\Admin\AppData\Local\Temp\2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe
"C:\Users\Admin\AppData\Local\Temp\2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\2c899da6efdb9a6abec2de261e88db296108375e721a4929ba7596f0b3928a1b.exe
  ?
  2⤵
  PID:1212

memory/1212-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1212-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1212-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/1212-140-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1212-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2592-134-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download