06bdd47d8e0c46fba022a535d49e372d656201f12c5825b6bb13115c8df46087

Analysis

max time kernel
131s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
19/11/2023, 13:06

Target

SunloginClient_11.1.2.38529_x64.exe
Size

15.4MB
MD5

be65f20dcc142863143e20f8fc873592
SHA1

b6d87747314780ac24edc71e09a788cf6fe87b33
SHA256

06bdd47d8e0c46fba022a535d49e372d656201f12c5825b6bb13115c8df46087
SHA512

dd4d4d44c6407ea0ed303894661f4939132c150b121a258e716db615a6ad2d9015da4662b890ba5ca63f514bbf46395d53e3dd8d7a915fc041be31743f850629
SSDEEP

393216:qMxQsK5L/pehAxZBTrMkRp5QiCihC5qloRFQqZQGT1:q15L4/kRzQiC1/FQYrT1

Score

7^/10

upx

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1544-1-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1544-0-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-2-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-7-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-11-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-12-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-13-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-14-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-17-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-18-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-19-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx
behavioral1/memory/1144-20-0x000000013FBC0000-0x000000014222B000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1144	1544	SunloginClient_11.1.2.38529_x64.exe	28
PID 1544 wrote to memory of 1144	1544	SunloginClient_11.1.2.38529_x64.exe	28
PID 1544 wrote to memory of 1144	1544	SunloginClient_11.1.2.38529_x64.exe	28

C:\Users\Admin\AppData\Local\Temp\SunloginClient_11.1.2.38529_x64.exe
"C:\Users\Admin\AppData\Local\Temp\SunloginClient_11.1.2.38529_x64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\SunloginClient_11.1.2.38529_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\SunloginClient_11.1.2.38529_x64.exe" --mod=install --admin=1
  2⤵
  PID:1144

memory/1144-2-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-7-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-11-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-12-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-13-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-14-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-17-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-18-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-19-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1144-20-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1544-1-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download
memory/1544-0-0x000000013FBC0000-0x000000014222B000-memory.dmp

Filesize
38.4MB

Download