6ee4bd84546544ae8feaa2c6fa722986eb9f082a0faaa1671a0e2fee61d947e7

Analysis

max time kernel
222s
max time network
242s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:03

Target

17edad88397803f6b1f03ba3c200bed1.exe
Size

85KB
MD5

17edad88397803f6b1f03ba3c200bed1
SHA1

b2cba259eda774e65c8d63a4601c0d3a0be8c37f
SHA256

6ee4bd84546544ae8feaa2c6fa722986eb9f082a0faaa1671a0e2fee61d947e7
SHA512

8004a4b79092f822bc16f3f0e7758bd7892c55607661a7ec47f9c33ef1ba7d38dc529a65c481da1523b7a99ba46dc964f4d333d0c5bc27cc03698b598df28c12
SSDEEP

1536:qUWR/D8c4uLIu5tj9rWHHS99rzDQYLV8VdLr+k/89ec:qCcTUcR7fDQo8VBh/Ie

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/820-0-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
820	17edad88397803f6b1f03ba3c200bed1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2716	820	17edad88397803f6b1f03ba3c200bed1.exe	91
PID 820 wrote to memory of 2716	820	17edad88397803f6b1f03ba3c200bed1.exe	91
PID 820 wrote to memory of 2716	820	17edad88397803f6b1f03ba3c200bed1.exe	91
PID 820 wrote to memory of 2716	820	17edad88397803f6b1f03ba3c200bed1.exe	91
PID 820 wrote to memory of 2716	820	17edad88397803f6b1f03ba3c200bed1.exe	91

memory/820-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/820-1-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/820-3-0x0000000002060000-0x0000000002072000-memory.dmp

Filesize
72KB

Download
memory/820-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/820-6-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/820-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download