97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e

Analysis

max time kernel
45s
max time network
133s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10/09/2022, 11:23

Target

97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe
Size

2.4MB
MD5

a7d365aef9ed428121a4cad1b2ff603a
SHA1

6f5e5bfc1d767842c4da43a6071f61f70278339f
SHA256

97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e
SHA512

6443fa6b2a32fcc883e5695fe515b3ed17f56f052b1b429204cfaac213895257109d9a4a4a3320754b97e62ed2f075f55d9d32e5b91f9c868de15784cb525343
SSDEEP

49152:kf0XznRm7WFJCSmzGZDNPbwl7LTin3xeG+h:YqY7WFJlmzGLwl7

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2032-59-0x00000000001D0000-0x00000000001E8000-memory.dmp	upx
behavioral1/memory/2032-64-0x00000000001D0000-0x00000000001E8000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	2032	WerFault.exe	26

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2032	97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 764	2032	97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe	27
PID 2032 wrote to memory of 764	2032	97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe	27
PID 2032 wrote to memory of 764	2032	97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe	27
PID 2032 wrote to memory of 764	2032	97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe	27

C:\Users\Admin\AppData\Local\Temp\97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe
"C:\Users\Admin\AppData\Local\Temp\97211de2eb68f70b0098ec42cbff629f4506ab57ff531678f395ab1faeebe07e.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 808
  2⤵
  - Program crash
  PID:764

memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000010000000-0x000000001029B000-memory.dmp

Filesize
2.6MB

Download
memory/2032-58-0x0000000010033000-0x0000000010285000-memory.dmp

Filesize
2.3MB

Download
memory/2032-59-0x00000000001D0000-0x00000000001E8000-memory.dmp

Filesize
96KB

Download
memory/2032-61-0x0000000010001000-0x0000000010030000-memory.dmp

Filesize
188KB

Download
memory/2032-60-0x00000000365C0000-0x00000000365D0000-memory.dmp

Filesize
64KB

Download
memory/2032-62-0x0000000010001000-0x0000000010030000-memory.dmp

Filesize
188KB

Download
memory/2032-64-0x00000000001D0000-0x00000000001E8000-memory.dmp

Filesize
96KB

Download
memory/2032-65-0x0000000004380000-0x0000000004595000-memory.dmp

Filesize
2.1MB

Download