113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347

Analysis

max time kernel
96s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 18:42

Target

113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
Size

289KB
MD5

703afe936650346a0e358dce51cab2e6
SHA1

1d8bf3ebb888529979ca2e34282387ffe5995eec
SHA256

113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347
SHA512

a581a6a74bb99f17388cb91343f18581c6e566098d3a413965f807c7f4c386e23d8b6430323ac04f2b8df3fbe4e964c338d2a5aaedaa5d118a6e62685a2bd999
SSDEEP

3072:BicL0cRBsQB80PFvWOgoHi2PxayGYF/LwrZCuhw4oSkrY:0cLjsQf5goCCSVRwfvrY

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1016-132-0x0000000000C20000-0x0000000000C6A000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1028	1016	WerFault.exe	81
1788	1016	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
1016	113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe

C:\Users\Admin\AppData\Local\Temp\113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe
"C:\Users\Admin\AppData\Local\Temp\113054c0d4e685e66a1c02e499c9a3b9ca9c69c40ecda4c733f160cc6703d347.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 244
  2⤵
  - Program crash
  PID:1028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 252
  2⤵
  - Program crash
  PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1016 -ip 1016
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1016 -ip 1016
1⤵
PID:2364

memory/1016-132-0x0000000000C20000-0x0000000000C6A000-memory.dmp

Filesize
296KB

Download