24de94e80f7827f379a2b1fac1fd513ac3a4d9d0f0b6c3a602de039448276c0d

Analysis

max time kernel
150s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:34

Target

24de94e80f7827f379a2b1fac1fd513ac3a4d9d0f0b6c3a602de039448276c0d.exe
Size

99KB
MD5

31161d796f6fa8a4fc0d5a0fa5712392
SHA1

c411cf95836e8af5af5c91e864ed4c3af92ce366
SHA256

24de94e80f7827f379a2b1fac1fd513ac3a4d9d0f0b6c3a602de039448276c0d
SHA512

26d7b9d2adc93752f91367794cb9d0c834be6dcaf988b8ef8391eefc8740db59fa6df4f3c06bfa322a9b055a8b414f9648a4d4b1b6e8fc0a61312ab019cdcfba
SSDEEP

3072:gwi089AvUB1LZPE1AAQvCTjE/j15AY41C:s0wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3940-132-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3496	3940	WerFault.exe	79

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3940	24de94e80f7827f379a2b1fac1fd513ac3a4d9d0f0b6c3a602de039448276c0d.exe

C:\Users\Admin\AppData\Local\Temp\24de94e80f7827f379a2b1fac1fd513ac3a4d9d0f0b6c3a602de039448276c0d.exe
"C:\Users\Admin\AppData\Local\Temp\24de94e80f7827f379a2b1fac1fd513ac3a4d9d0f0b6c3a602de039448276c0d.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 792
  2⤵
  - Program crash
  PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3940 -ip 3940
1⤵
PID:4372

memory/3940-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3940-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3940-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download