207819117152d2d8eed930378a6d709252ab819b59192791ba5bb5d0a5f97a41

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:56

Target

619a47593e7867b11d675b9a8884cd94.exe
Size

69KB
MD5

619a47593e7867b11d675b9a8884cd94
SHA1

7f00268579aa5422f9c3049e60505e8a50a92a05
SHA256

207819117152d2d8eed930378a6d709252ab819b59192791ba5bb5d0a5f97a41
SHA512

f0448118659d8f88b0ce03380d5239f599eea22d4648a54449084ed84b26687c2b53e19cc8a77adb34093dfbc27d5dee4a19197e15a577262aa2e2da3a40a05e
SSDEEP

1536:lvVTskgrSq3mSTUJPF90JGT3gPAsZvaFIJFvdKV5/mqs/Yw:bWrSqmSTUJX00gYsvP165Ov/j

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2748-3-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2748-7-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2748-9-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2748-10-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral1/memory/2748-11-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2748	2456	619a47593e7867b11d675b9a8884cd94.exe	28
PID 2456 wrote to memory of 2748	2456	619a47593e7867b11d675b9a8884cd94.exe	28
PID 2456 wrote to memory of 2748	2456	619a47593e7867b11d675b9a8884cd94.exe	28
PID 2456 wrote to memory of 2748	2456	619a47593e7867b11d675b9a8884cd94.exe	28

C:\Users\Admin\AppData\Local\Temp\619a47593e7867b11d675b9a8884cd94.exe
"C:\Users\Admin\AppData\Local\Temp\619a47593e7867b11d675b9a8884cd94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\619a47593e7867b11d675b9a8884cd94.exe
  ?
  2⤵
  PID:2748

memory/2456-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2456-1-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2456-12-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2748-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2748-4-0x0000000001000000-0x000000000100B000-memory.dmp

Filesize
44KB

Download
memory/2748-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2748-7-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2748-9-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2748-10-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2748-11-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download