6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a

Analysis

max time kernel
148s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 02:51

Target

6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe
Size

1003KB
MD5

071cceaf09dc58f3ccfa818d77aecad0
SHA1

8f9c6120214f3dcb2f1cc3b2989ab41afa20fd11
SHA256

6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a
SHA512

80d6153b9ca9038a582b37dbb6a478f8a231175b62d4dc6c68560c9fd788d67602598d7a0dce63407cd8f39be0f51361946018088e43e0131377237611bf802e
SSDEEP

24576:+bsmPVVEfa7UJLQZNtURdk6W9HzbQBaKU2qe:ksmciIVQHtz6W9Hz0Pq

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2896-132-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral2/memory/2896-133-0x0000000000400000-0x000000000056C000-memory.dmp	upx
behavioral2/memory/2896-135-0x0000000000400000-0x000000000056C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4932	2896	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1128	2896	6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe	83
PID 2896 wrote to memory of 1128	2896	6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe	83
PID 2896 wrote to memory of 1128	2896	6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe	83

C:\Users\Admin\AppData\Local\Temp\6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe
"C:\Users\Admin\AppData\Local\Temp\6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe
  C:\Users\Admin\AppData\Local\Temp\6613f064c4e4414f0b56735fff04ed74a996117c6c271dd517279a5b6daa798a.exe
  2⤵
  PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 504
  2⤵
  - Program crash
  PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2896 -ip 2896
1⤵
PID:4316

memory/2896-132-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/2896-133-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/2896-135-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download