06d3e3d5b420261fab2665e4f97001522b94866fd4a62738a8d74132ef699ea3

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2023 14:05

Target

079a7f3a71efa52fb3b2261a9ace99980f61d4e6d7456c9f4cbb09d064628480.exe
Size

1.2MB
MD5

b40d7b11a7365f7d873443f8d30213e3
SHA1

58470378bc07a0a7f78ed3223034cc545c356600
SHA256

079a7f3a71efa52fb3b2261a9ace99980f61d4e6d7456c9f4cbb09d064628480
SHA512

d516b05f18d76988ee51022937f9e71f4cc6046728db2851c769f59f035ca94e6089a7471222a5c0d9f2238e037d3a7bc6dffcfba57a9ef0f03af2c02a695cfd
SSDEEP

24576:bvPECP1wFC0/xGQyv8RibevHvV4MUyiOuf3XelzqgoPZpli/7uZeVha9G:bHECP1edxNC8RfncyFuf3cVoPHM/7uZo

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4444-0-0x0000000000400000-0x000000000064B000-memory.dmp	upx
behavioral2/memory/4444-1-0x0000000000400000-0x000000000064B000-memory.dmp	upx
behavioral2/memory/4444-3-0x0000000000400000-0x000000000064B000-memory.dmp	upx
behavioral2/memory/4444-2-0x0000000000400000-0x000000000064B000-memory.dmp	upx
behavioral2/memory/4444-4-0x0000000000400000-0x000000000064B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1996	4444	079a7f3a71efa52fb3b2261a9ace99980f61d4e6d7456c9f4cbb09d064628480.exe	89
PID 4444 wrote to memory of 1996	4444	079a7f3a71efa52fb3b2261a9ace99980f61d4e6d7456c9f4cbb09d064628480.exe	89

C:\Users\Admin\AppData\Local\Temp\079a7f3a71efa52fb3b2261a9ace99980f61d4e6d7456c9f4cbb09d064628480.exe
"C:\Users\Admin\AppData\Local\Temp\079a7f3a71efa52fb3b2261a9ace99980f61d4e6d7456c9f4cbb09d064628480.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c ver.exe
  2⤵
  PID:1996

memory/4444-0-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/4444-1-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/4444-3-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/4444-2-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/4444-4-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download