3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 22:34

Target

3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04.exe
Size

524KB
MD5

7a500c6893edcb255f3fd39166f21a30
SHA1

d3ccf8e47531f483dc924c6809912abecec02060
SHA256

3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04
SHA512

f50aea4e8a2f659c82ce76c219d2130896a022bafdbf6bc4b94628c9cfde3881795e5ec1ebc77626be5678f5c4490fd70a2199108516bb8162041667553e60e8
SSDEEP

12288:SjkArEN249AyE/rbaMct4bO2/7WZn8ET+yZWBgReoizwtUlW6svUx:FFE//Tct4bOs7W5T+aWBgRe3wtUlWdMx

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1112-56-0x0000000000400000-0x00000000004FB000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
688	1112	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 688	1112	3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04.exe	28
PID 1112 wrote to memory of 688	1112	3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04.exe	28
PID 1112 wrote to memory of 688	1112	3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04.exe	28
PID 1112 wrote to memory of 688	1112	3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04.exe	28

C:\Users\Admin\AppData\Local\Temp\3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04.exe
"C:\Users\Admin\AppData\Local\Temp\3d99014e38e75efce3ba663d9f5227587c3135005dd810a0ad08872a6fa93a04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 228
  2⤵
  - Program crash
  PID:688

memory/1112-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1112-56-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download