b10727e82dab6c16a574bf0f9bbf2de72cc0fce5619a2ed0ae24b4183b469021

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:29

Target

edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe
Size

6.8MB
MD5

5c4e43b808d27a47b798f7cfc317b8d8
SHA1

f53dd6ce10b9680409110f995febd473a0898d80
SHA256

edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987
SHA512

baf7272d3213ae2fb0b6faa17ed601851c6043b5c10703ab059f4b162bb54414a098ce7e17ab65606c829a8141f773fc165ada8de5c20f23a9203651f3ba037b
SSDEEP

98304:g/zqrMdb1LupYWEx4yuMMvpdzBVHgGDj2i20H1N7MO30blPZDvBGCBHh:g7+S1LupYR6HjXAISi2WN7wblPZ7DB

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1916-0-0x0000000000400000-0x0000000001DD5000-memory.dmp	upx
behavioral1/memory/1916-3-0x0000000000400000-0x0000000001DD5000-memory.dmp	upx
behavioral1/memory/1916-4-0x0000000000400000-0x0000000001DD5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2712	1916	edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe	28
PID 1916 wrote to memory of 2712	1916	edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe	28
PID 1916 wrote to memory of 2712	1916	edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe	28
PID 1916 wrote to memory of 2712	1916	edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe	28

C:\Users\Admin\AppData\Local\Temp\edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe
"C:\Users\Admin\AppData\Local\Temp\edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2712

memory/1916-0-0x0000000000400000-0x0000000001DD5000-memory.dmp

Filesize
25.8MB

Download
memory/1916-1-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1916-3-0x0000000000400000-0x0000000001DD5000-memory.dmp

Filesize
25.8MB

Download
memory/1916-4-0x0000000000400000-0x0000000001DD5000-memory.dmp

Filesize
25.8MB

Download
memory/1916-5-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download