fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 17:40

Target

fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff.exe
Size

169KB
MD5

77abdeb661498d34c244cc7535108f60
SHA1

525667e467607a9323aea4667d4392418b5e2621
SHA256

fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff
SHA512

bacb3b8127831db7ee58d06308693dbba42551a8c176b1f3449cf746e416a2230d0bd6eae54785c25fd559343b69990701bf6211949235c648669b52151705fb
SSDEEP

3072:VobQatKHZw3Zvi+iY1mPTa3LXluHULgza3uJgrca3fXRatdh6:VwQatuZuNi+oTwz4crca3fhaE

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1036	fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ffmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0004000000022dea-133.dat	upx
behavioral2/files/0x0004000000022dea-134.dat	upx
behavioral2/memory/1036-136-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3592	1036	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1036	1312	fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff.exe	84
PID 1312 wrote to memory of 1036	1312	fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff.exe	84
PID 1312 wrote to memory of 1036	1312	fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff.exe	84

C:\Users\Admin\AppData\Local\Temp\fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff.exe
"C:\Users\Admin\AppData\Local\Temp\fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ffmgr.exe
  C:\Users\Admin\AppData\Local\Temp\fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ffmgr.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 260
    3⤵
    - Program crash
    PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1036 -ip 1036
1⤵
PID:2916

C:\Users\Admin\AppData\Local\Temp\fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ffmgr.exe

Filesize
99KB

MD5
f57eee1185dee33198b752dd1f66ad55

SHA1
b60f88d65f8805bf2ca095ecd1727b15eed4ff12

SHA256
6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

SHA512
cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

Download Submit
C:\Users\Admin\AppData\Local\Temp\fd5c80d139c56764514474db1c03b045c42f21c2b20ad192f9ed5ce8780bc0ffmgr.exe

Filesize
99KB

MD5
f57eee1185dee33198b752dd1f66ad55

SHA1
b60f88d65f8805bf2ca095ecd1727b15eed4ff12

SHA256
6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

SHA512
cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

Download Submit
memory/1036-136-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1312-135-0x00000000007B0000-0x00000000007DF000-memory.dmp

Filesize
188KB

Download