5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039

Analysis

max time kernel
136s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 05:16

Target

5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039.exe
Size

117KB
MD5

6c9e5e789682fd0ede326791480c4530
SHA1

f39b7236213850e58a7a5113af394a19f2098e7e
SHA256

5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039
SHA512

317c7c387d0f125832c6f4bd167e183a006befcc2058997ade7722984d9b7992aa25d04162d4fd24a6ac950897fe69f69e90456ad2ee440c7dcefe474cdd63da
SSDEEP

3072:R9FmMuRdbXj3teNyNGV4n6U9/Jz+2sFKI/RCQ:d8n3teNyNGV2HJzBgK+MQ

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4876-132-0x0000000001000000-0x0000000001045000-memory.dmp	upx
behavioral2/memory/4876-134-0x0000000001000000-0x0000000001045000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
444	4876	WerFault.exe	81
1192	4876	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 444	4876	5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039.exe	84
PID 4876 wrote to memory of 444	4876	5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039.exe	84
PID 4876 wrote to memory of 444	4876	5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039.exe	84

C:\Users\Admin\AppData\Local\Temp\5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039.exe
"C:\Users\Admin\AppData\Local\Temp\5bbca78602c1ab15d32747f6b1e7fd7efc8984925aa60202d705d9627e36a039.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 308
  2⤵
  - Program crash
  PID:444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 308
  2⤵
  - Program crash
  PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4876 -ip 4876
1⤵
PID:1776

memory/4876-132-0x0000000001000000-0x0000000001045000-memory.dmp

Filesize
276KB

Download
memory/4876-134-0x0000000001000000-0x0000000001045000-memory.dmp

Filesize
276KB

Download