47c73931320e4135640dd56d8e5ef42887796ede9b96ee9086b4b44d2f9b3dec

Analysis

max time kernel
84s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:22

Target

47c73931320e4135640dd56d8e5ef42887796ede9b96ee9086b4b44d2f9b3dec.exe
Size

99KB
MD5

4bb78fc419346673ba653ab78cc88d01
SHA1

0337d809fb8cff1e25ef1e2f17de43c4b1299a61
SHA256

47c73931320e4135640dd56d8e5ef42887796ede9b96ee9086b4b44d2f9b3dec
SHA512

4c5d32ed3093b7e51984a9db5c29eeda6cb55d1caa1486a32ab5fdab3e3f171670a712a56b31f78bc07e37748df6d3a3561210dbc110594b34a3bfdba8df78dc
SSDEEP

3072:Awi089AvUB1LZPE1AAQvCTjE/j15AY41C:M0wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/808-132-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3768	808	WerFault.exe	83

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
808	47c73931320e4135640dd56d8e5ef42887796ede9b96ee9086b4b44d2f9b3dec.exe

C:\Users\Admin\AppData\Local\Temp\47c73931320e4135640dd56d8e5ef42887796ede9b96ee9086b4b44d2f9b3dec.exe
"C:\Users\Admin\AppData\Local\Temp\47c73931320e4135640dd56d8e5ef42887796ede9b96ee9086b4b44d2f9b3dec.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 600
  2⤵
  - Program crash
  PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 808 -ip 808
1⤵
PID:492

memory/808-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/808-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/808-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download