2ff50d2ee027e2834008b6fb01898954eac3399c9d0b7c526763e0c1597735df

Analysis

max time kernel
154s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:29

Target

2ff50d2ee027e2834008b6fb01898954eac3399c9d0b7c526763e0c1597735df.exe
Size

99KB
MD5

2fca5621eea693eb9ceb70b381f67f62
SHA1

ded1183d922912ee3ae6dc3c5f6a0a9ce2bb6151
SHA256

2ff50d2ee027e2834008b6fb01898954eac3399c9d0b7c526763e0c1597735df
SHA512

c1b215ecc1b0be865dfb0321e91c8c594fb69a0635f1887bce5afd640e77b1984c85788046d4e955720c80b3aa74ec43da8d71b17f449afb6e8f515fc704f3fc
SSDEEP

3072:4wi089AvUB1LZPE1AAQvCTjE/j15AY41C:U0wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4348-132-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	4348	WerFault.exe	83

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4348	2ff50d2ee027e2834008b6fb01898954eac3399c9d0b7c526763e0c1597735df.exe

C:\Users\Admin\AppData\Local\Temp\2ff50d2ee027e2834008b6fb01898954eac3399c9d0b7c526763e0c1597735df.exe
"C:\Users\Admin\AppData\Local\Temp\2ff50d2ee027e2834008b6fb01898954eac3399c9d0b7c526763e0c1597735df.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 864
  2⤵
  - Program crash
  PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4348 -ip 4348
1⤵
PID:204

memory/4348-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4348-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4348-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download