1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1

Analysis

max time kernel
142s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 20:58

Target

1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe
Size

16.9MB
MD5

33bf73ec35249d19b3be991e45476ca9
SHA1

2a7d69870a4f32e5f67139dfd27c4e3460cc3675
SHA256

1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1
SHA512

ae5b9bda9e21f03192a6eb651154307b0cbf9d920e173b702b5a044f5e93223cf0a999ea24dabdb24bf802d6518f17d9f11e3592432fbfda0d3ec2d2113f3ec1
SSDEEP

49152:ywHUupes/mJK08VYYPhBt39mAhZPHtMBvdprol/VZjxb35fGm/U7XDgPF4x9Jfzk:yA

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1496-13-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral2/memory/1496-14-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral2/memory/1496-15-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral2/memory/1496-16-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral2/memory/1496-17-0x0000000013140000-0x00000000145E8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 1496	3100	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	89
PID 3100 wrote to memory of 1496	3100	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	89
PID 3100 wrote to memory of 1496	3100	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	89
PID 3100 wrote to memory of 1496	3100	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	89
PID 3100 wrote to memory of 1496	3100	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	89

C:\Users\Admin\AppData\Local\Temp\1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe
"C:\Users\Admin\AppData\Local\Temp\1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\windows\SysWOW64\grpconv.exe
  C:\windows\syswow64\grpconv.exe
  2⤵
  PID:1496

memory/1496-13-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/1496-17-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/1496-16-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/1496-15-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/1496-14-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/3100-5-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-7-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-10-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-11-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-12-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-6-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-0-0x00000000016A0000-0x00000000016A1000-memory.dmp

Filesize
4KB

Download
memory/3100-4-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-3-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-1-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/3100-18-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download