31dce85e4c3a520c48e89a4a30111721d99f28bbdf4de7dd17a663eecc24f4a5

Analysis

max time kernel
138s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 08:29

Target

31dce85e4c3a520c48e89a4a30111721d99f28bbdf4de7dd17a663eecc24f4a5.exe
Size

99KB
MD5

ee5f26e49cf56dbcd17c8ad4fe871463
SHA1

c0a18ab997ba5f18ca83b2e94d94d0bc8a01c0ba
SHA256

31dce85e4c3a520c48e89a4a30111721d99f28bbdf4de7dd17a663eecc24f4a5
SHA512

b25e7cdc7da9e0ddc333c7b2e9894a3aae546eabf5279958cab1eaa9507eda055f45fb98ad9bf96b1b4fce870840460e90b2ef88ef1890fa1704a2129f668f49
SSDEEP

3072:gwi089AvUB1LZPE1AAQvCTjE/j15AY41C:s0wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1368-132-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	1368	WerFault.exe	57

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1368	31dce85e4c3a520c48e89a4a30111721d99f28bbdf4de7dd17a663eecc24f4a5.exe

C:\Users\Admin\AppData\Local\Temp\31dce85e4c3a520c48e89a4a30111721d99f28bbdf4de7dd17a663eecc24f4a5.exe
"C:\Users\Admin\AppData\Local\Temp\31dce85e4c3a520c48e89a4a30111721d99f28bbdf4de7dd17a663eecc24f4a5.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 508
  2⤵
  - Program crash
  PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1368 -ip 1368
1⤵
PID:4444

memory/1368-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1368-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1368-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download