dd66389eec236b96dcb3dffed7073c1290845114678f2508223ea655f65ef210

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 13:51

Target

1a9868d81689db0e016f32348495cdaa.exe
Size

107KB
MD5

1a9868d81689db0e016f32348495cdaa
SHA1

023fa0cc37fdfe15bce932e146e32b329ae9e6dd
SHA256

dd66389eec236b96dcb3dffed7073c1290845114678f2508223ea655f65ef210
SHA512

dc0a3e025d31b9065de5ec02935bd3b84ec6b90e0974a1c6aa5aec2a2a8e5271a434b5366c278d4a064695621029768f957f27d0557d7aea2118265b4ddbb15e
SSDEEP

3072:vEg+gpj2m3aAM6VsIIrJZnEoWNVR+IRt1VH0+8:8CpBKEVxIMoWNVb1m

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1012-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1012	1a9868d81689db0e016f32348495cdaa.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4888	1012	1a9868d81689db0e016f32348495cdaa.exe	22
PID 1012 wrote to memory of 4888	1012	1a9868d81689db0e016f32348495cdaa.exe	22
PID 1012 wrote to memory of 4888	1012	1a9868d81689db0e016f32348495cdaa.exe	22
PID 1012 wrote to memory of 4888	1012	1a9868d81689db0e016f32348495cdaa.exe	22
PID 1012 wrote to memory of 4888	1012	1a9868d81689db0e016f32348495cdaa.exe	22

memory/1012-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1012-3-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/1012-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1012-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1012-1-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download