a3172e45bb1824fa625a04ff1d7e08617de13309ba9d31fb6b03ec9a921f345b

Analysis

max time kernel
82s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 09:11

Target

96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe
Size

114KB
MD5

3f04ef0e701d181d0b1971c7661930a9
SHA1

fb76e2613c38621794fdd701f2a3ab6245b63695
SHA256

96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a
SHA512

799f26abf17139128f222b3ea010b9bd14d20a8c61a60313ec9a043c40c96e88a6eabb3bec2f640b834c608e306e16b619d699b63896f486315f0daa7fbfb89f
SSDEEP

3072:bi6paumKN81UAVH/kEOjZuMmlvAwTNZii:EovkME1MSocNL

Score

8^/10

upx

Executes dropped EXE 1 IoCs

Processes:

96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe

pid process

5036 96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe

pid	process
5036	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe	upx
C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe	upx
behavioral14/memory/5036-139-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 5036 WerFault.exe 96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe

pid	pid_target	process	target process
1980	5036	WerFault.exe	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe

description	pid	process	target process
PID 1284 wrote to memory of 5036	1284	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe
PID 1284 wrote to memory of 5036	1284	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe
PID 1284 wrote to memory of 5036	1284	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe	96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe

C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe
"C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe
C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe
2⤵
- Executes dropped EXE
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 264
3⤵
- Program crash
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5036 -ip 5036
1⤵
PID:3136

C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
C:\Users\Admin\AppData\Local\Temp\96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7amgr.exe
Filesize
105KB

MD5
3235c81e22fad625ce09ae351091f7cc

SHA1
1a670de8ab6014928459f0c1631db644f7d7526e

SHA256
85d274964f8e3cba910a4922bdbdc0ed3b064c0045db18c85d8d2a853d00e7a6

SHA512
95797149ba60dc13795798549d566f309796ac7daad849c5295516855f53617c92e29a119d93a5da87d50a16d6a34308b3b0b0d0b3974b899fe2f21ca83f041b

Download Submit
memory/1284-135-0x0000000000F40000-0x0000000000F61000-memory.dmp

Filesize
132KB

Download
memory/1284-140-0x0000000000F40000-0x0000000000F61000-memory.dmp

Filesize
132KB

Download
memory/5036-136-0x0000000000000000-mapping.dmp

Download
memory/5036-139-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download