5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51

Analysis

max time kernel
123s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 17:21

Target

5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
Size

234KB
MD5

7c417476aa335db03433180a3276e5ae
SHA1

40068932a90e2128299dcf23d82ae20cdaf69689
SHA256

5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51
SHA512

cb26b9212b00860567eb78da735ee7932ab524b732489d788dd3366de769c7c3f2db3757d9b4edc88172265c02a1651dcdc5430519d20f2eda9c48b708e48b3e
SSDEEP

6144:2xV8dI3bxRETtXaz/OJepymej5viyT5O/q9DUGEyoSW:2n8dI3b7ETtKKepymejF5aeDUGNoSW

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2040-132-0x0000000000400000-0x00000000004DF000-memory.dmp	upx
behavioral2/memory/2040-135-0x0000000000400000-0x00000000004DF000-memory.dmp	upx
behavioral2/memory/2040-137-0x0000000000400000-0x00000000004DF000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4900	2040	WerFault.exe	45
3024	2040	WerFault.exe	45

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4900	2040	5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe	83
PID 2040 wrote to memory of 4900	2040	5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe	83
PID 2040 wrote to memory of 4900	2040	5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe	83

C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
"C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 464
  2⤵
  - Program crash
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 464
  2⤵
  - Program crash
  PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2040 -ip 2040
1⤵
PID:1932

memory/2040-132-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2040-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2040-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download