85b2198e25e6ab70ca043e2bf2ec3c8e3a7b1e159596432cd7b519f65f8c5ac6

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 22:45

Target

b9da4befb695d1d43db21227ace70e11.exe
Size

142KB
MD5

b9da4befb695d1d43db21227ace70e11
SHA1

525bc33d9fb4b3c3b3e78e09dd65dd37eaeff761
SHA256

85b2198e25e6ab70ca043e2bf2ec3c8e3a7b1e159596432cd7b519f65f8c5ac6
SHA512

6f250bf847ab63ec05d2dd9d808f60df7753d347f3c7df7049aa8f226bf2be276839a08709c22d330e8d48d723bf375919eb57cf2b29f1a30bc20a62756428f5
SSDEEP

3072:BB0jlSWamkNNYgqvBylnm4/Bs4v8gOqFRiYAbKklVKciCRvm:BMlSyumB0g4v8J2gNRv

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1992	b9da4befb695d1d43db21227ace70e11.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2680	1992	b9da4befb695d1d43db21227ace70e11.exe	28
PID 1992 wrote to memory of 2680	1992	b9da4befb695d1d43db21227ace70e11.exe	28
PID 1992 wrote to memory of 2680	1992	b9da4befb695d1d43db21227ace70e11.exe	28
PID 1992 wrote to memory of 2680	1992	b9da4befb695d1d43db21227ace70e11.exe	28
PID 1992 wrote to memory of 2680	1992	b9da4befb695d1d43db21227ace70e11.exe	28
PID 1992 wrote to memory of 2680	1992	b9da4befb695d1d43db21227ace70e11.exe	28
PID 1992 wrote to memory of 2680	1992	b9da4befb695d1d43db21227ace70e11.exe	28

memory/1992-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1992-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1992-3-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1992-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2680-4-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2680-5-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2680-7-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2680-10-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download