7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9

Analysis

max time kernel
16s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe
Size

154KB
MD5

b473debf60055a46668e289c50cea946
SHA1

67518b93085b93a61747ee0cd371671d791b1d17
SHA256

7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9
SHA512

ac78c75983ccfee7a31839de0d6417a50ef2be3d4c9786ad99a9ad3f4d2b9137fac71e5bbdf881d6e505a2063dee84409ab7ef43133088bf76220007e7ebda07
SSDEEP

3072:wx76iyC/Xhap3uBiec62wIBT65iHFIc8D09eZ8qHsNLR32mrB0Zw/09NXz56fW+:wYiBpk34iec6lM65ilIY9MLMNFhr2qc2

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1904-56-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1904-67-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	1740	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1904 wrote to memory of 1740	1904	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	27
PID 1740 wrote to memory of 1876	1740	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	28
PID 1740 wrote to memory of 1876	1740	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	28
PID 1740 wrote to memory of 1876	1740	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	28
PID 1740 wrote to memory of 1876	1740	7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe	28

C:\Users\Admin\AppData\Local\Temp\7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe
"C:\Users\Admin\AppData\Local\Temp\7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe
  "C:\Users\Admin\AppData\Local\Temp\7b949fc4bfd954c53271891d932bf7dcf6844d7b2e09d7981f4cd74714726be9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 96
    3⤵
    - Program crash
    PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-58-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-74-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1740-71-0x0000000000410000-0x0000000000412000-memory.dmp

Filesize
8KB

Download
memory/1904-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1904-67-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download