31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df

General

Target

31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
Size

146KB
MD5

9cc162dc30cd17eaf8efede2ebcc0c8c
SHA1

b267c9a8c78b0a601931538ac0f805186b9fee92
SHA256

31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df
SHA512

07f9c6ada30256048d1fa7b71dc1f44fa3678cf23371f7a90a8a91d8457aa10c8b40aaa316d5705c5620e6650f3dd9faf65d17caaa7cd19dc61ee6e45023f210

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/560-131-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/560-133-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/560-134-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

description	pid	process	target process
PID 624 set thread context of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2916	560	WerFault.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
1208	560	WerFault.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

pid process

624 31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

pid	process
624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

description	pid	process	target process
PID 624 wrote to memory of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
PID 624 wrote to memory of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
PID 624 wrote to memory of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
PID 624 wrote to memory of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
PID 624 wrote to memory of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
PID 624 wrote to memory of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
PID 624 wrote to memory of 560	624	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe	31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe

C:\Users\Admin\AppData\Local\Temp\31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
"C:\Users\Admin\AppData\Local\Temp\31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Admin\AppData\Local\Temp\31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe
"C:\Users\Admin\AppData\Local\Temp\31c52fec2654717cb5b0d04c9fce32b41229af3e13d0507e2518e798f089b6df.exe"
2⤵
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 344
3⤵
- Program crash
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 348
3⤵
- Program crash
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 560 -ip 560
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 560 -ip 560
1⤵
PID:1868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-130-0x0000000000000000-mapping.dmp

Download
memory/560-131-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/560-133-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/560-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads