9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 04:23

Target

9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5.exe
Size

640KB
MD5

6b3a7e584dc24d1159e40173c1dc0820
SHA1

ecf583965d044af92565fd306a89306bc617776e
SHA256

9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5
SHA512

98ac864f948b4443d003410b85038311517123e900808d2abba06c210b52f438e1cf43654e6599a358826e8d0fec8d3f1acaeb9f042facd49f3e1fd33b74267b
SSDEEP

12288:Ja4TLdRUuRA925xVk+s8z1FTFqPKPfrWPFFGPFRaIc:J3/TOMs8RVFXq6FUZ

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1248-54-0x0000000000400000-0x0000000000594000-memory.dmp	upx
behavioral1/memory/1248-57-0x0000000000400000-0x0000000000594000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	1248	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 1420	1248	9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5.exe	26
PID 1248 wrote to memory of 1420	1248	9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5.exe	26
PID 1248 wrote to memory of 1420	1248	9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5.exe	26
PID 1248 wrote to memory of 1420	1248	9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5.exe	26

C:\Users\Admin\AppData\Local\Temp\9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5.exe
"C:\Users\Admin\AppData\Local\Temp\9043c76967b0129fc5fbaae5f169e93afce6f810f6c63668f85bd0072b5f27b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 248
  2⤵
  - Program crash
  PID:1420

memory/1248-54-0x0000000000400000-0x0000000000594000-memory.dmp

Filesize
1.6MB

Download
memory/1248-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1248-57-0x0000000000400000-0x0000000000594000-memory.dmp

Filesize
1.6MB

Download