2dc06e5d902fa9ca22897bd5492f5bbf9b8df082315fd98d5d46ae63bead0691

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 15:11

Target

8ca5eedcc3e1ba9b3294f58899db2ce1.exe
Size

142KB
MD5

8ca5eedcc3e1ba9b3294f58899db2ce1
SHA1

0a9b0db3187403ae53588b9c354f8398f8e98494
SHA256

2dc06e5d902fa9ca22897bd5492f5bbf9b8df082315fd98d5d46ae63bead0691
SHA512

9fe25855aca6aa01492d0876db766abce60b2583a38c96753fe6defcf85f836ae8b8a7e398c62f7cb4cdb0c6515ea3e69b13b28442ce5583ec76ca69b42738ea
SSDEEP

1536:3vQJqbC3hfHT4s21jcxIc237gBCFqXS7yBKBqYqw2zp//VNA637LDXuYdk7jvmWY:KxfzL2Nc+b7gBWO6QnzmeW3m6H/

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3408-0-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3408	8ca5eedcc3e1ba9b3294f58899db2ce1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 956	3408	8ca5eedcc3e1ba9b3294f58899db2ce1.exe	84
PID 3408 wrote to memory of 956	3408	8ca5eedcc3e1ba9b3294f58899db2ce1.exe	84
PID 3408 wrote to memory of 956	3408	8ca5eedcc3e1ba9b3294f58899db2ce1.exe	84
PID 3408 wrote to memory of 956	3408	8ca5eedcc3e1ba9b3294f58899db2ce1.exe	84
PID 3408 wrote to memory of 956	3408	8ca5eedcc3e1ba9b3294f58899db2ce1.exe	84

memory/3408-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3408-2-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/3408-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3408-4-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/3408-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download