7b23a666b13afaaba8005119e47c2f29f396c08a4d087abd3a0a254d3a6dbbe4 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
resource tags

arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system
submitted
16-07-2022 13:10

Sharing

Report Analysis Logs

General

Target

FSZJXW.exe
Size

423KB
MD5

480130235a7e456be7d7de31c47e7d07
SHA1

67baa1f65ad6244485ddcf819c64717981e92d2b
SHA256

7b23a666b13afaaba8005119e47c2f29f396c08a4d087abd3a0a254d3a6dbbe4
SHA512

6726ed8447ba254156fc60dfbb6b01e5e89861aab682345577a35d3fbacebc7f7580dab04dad23e09727e67aa5a48f0616a8473a56f2287c4c8f25efab058c1d

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1796-56-0x0000000000400000-0x00000000004DC000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1364 1796 WerFault.exe FSZJXW.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

FSZJXW.exe

description	pid	process	target process
PID 1796 wrote to memory of 1364	1796	FSZJXW.exe	WerFault.exe
PID 1796 wrote to memory of 1364	1796	FSZJXW.exe	WerFault.exe
PID 1796 wrote to memory of 1364	1796	FSZJXW.exe	WerFault.exe
PID 1796 wrote to memory of 1364	1796	FSZJXW.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FSZJXW.exe
"C:\Users\Admin\AppData\Local\Temp\FSZJXW.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 228
2⤵
- Program crash
PID:1364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-55-0x0000000000000000-mapping.dmp

Download
memory/1796-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1796-56-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download