b10727e82dab6c16a574bf0f9bbf2de72cc0fce5619a2ed0ae24b4183b469021

Analysis

max time kernel
0s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 01:29

Target

edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe
Size

6.8MB
MD5

5c4e43b808d27a47b798f7cfc317b8d8
SHA1

f53dd6ce10b9680409110f995febd473a0898d80
SHA256

edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987
SHA512

baf7272d3213ae2fb0b6faa17ed601851c6043b5c10703ab059f4b162bb54414a098ce7e17ab65606c829a8141f773fc165ada8de5c20f23a9203651f3ba037b
SSDEEP

98304:g/zqrMdb1LupYWEx4yuMMvpdzBVHgGDj2i20H1N7MO30blPZDvBGCBHh:g7+S1LupYR6HjXAISi2WN7wblPZ7DB

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1780-0-0x0000000000400000-0x0000000001DD5000-memory.dmp	upx
behavioral2/memory/1780-2-0x0000000000400000-0x0000000001DD5000-memory.dmp	upx
behavioral2/memory/1780-3-0x0000000000400000-0x0000000001DD5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2720	1780	edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe	27
PID 1780 wrote to memory of 2720	1780	edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe	27

C:\Users\Admin\AppData\Local\Temp\edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe
"C:\Users\Admin\AppData\Local\Temp\edd10a6753d9a7f629c534bff682a97d14397b53bab55eda2af434aab42e8987.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4908

memory/1780-0-0x0000000000400000-0x0000000001DD5000-memory.dmp

Filesize
25.8MB

Download
memory/1780-1-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download
memory/1780-2-0x0000000000400000-0x0000000001DD5000-memory.dmp

Filesize
25.8MB

Download
memory/1780-3-0x0000000000400000-0x0000000001DD5000-memory.dmp

Filesize
25.8MB

Download
memory/1780-4-0x0000000002010000-0x0000000002011000-memory.dmp

Filesize
4KB

Download