09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89

Analysis

max time kernel
158s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 17:56

Target

09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe
Size

499KB
MD5

6eeb0ca3294dacb042942f853aa42350
SHA1

ca63122ed7be0dacd5532e52241261565f75d5f5
SHA256

09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89
SHA512

661b36a3768059e8103087d212e364704e04d27227536cf53939e96f2312e1c3456d0da5c3bf663cb05c00b12c88bf4a27823216e76969d97fded0bfb49a0e34
SSDEEP

6144:CXXD6zNVVLp/AOAilRVIV2HYNO6s1ho/Gd2GXrVd+7HYNOK4BSdMNVjb7:CKNVZp/mYRiVdNdsjo/gBdfNQB+kv7

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4100	09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0008000000022e50-134.dat	upx
behavioral2/files/0x0008000000022e50-135.dat	upx
behavioral2/memory/4100-137-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	4100	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4100	1768	09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe	81
PID 1768 wrote to memory of 4100	1768	09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe	81
PID 1768 wrote to memory of 4100	1768	09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe	81

C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe
"C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe
  C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 260
    3⤵
    - Program crash
    PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4100 -ip 4100
1⤵
PID:4016

C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe

Filesize
104KB

MD5
1b8d3e127401ef0b666f129fa68a1a82

SHA1
47218021c6164911887138526185bd33c02d4bbd

SHA256
a00ecfd555960a71a4f06eafd801232f504481207736fcb7111a698cca95e8be

SHA512
acd37b10060cdd66e8191ab351126a57694df2f0ca821be942cafc78076f2d1c6809abe5a013db2e440ff4a5a749a3a7109be8485731b550e227699fd18385f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe

Filesize
104KB

MD5
1b8d3e127401ef0b666f129fa68a1a82

SHA1
47218021c6164911887138526185bd33c02d4bbd

SHA256
a00ecfd555960a71a4f06eafd801232f504481207736fcb7111a698cca95e8be

SHA512
acd37b10060cdd66e8191ab351126a57694df2f0ca821be942cafc78076f2d1c6809abe5a013db2e440ff4a5a749a3a7109be8485731b550e227699fd18385f8

Download Submit
memory/1768-132-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1768-136-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/4100-137-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download