04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453

Analysis

max time kernel
145s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 09:18

Target

04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe
Size

885KB
MD5

4a7f257f4a42a1236ad7ca874877bc7a
SHA1

16e1b5cb7575d98828a8489c0e0d08917b9ceab6
SHA256

04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453
SHA512

e3ed9c08285ca0dafc868e515371d224d8cf048a6cbb70cfb3b7e93488cd2b4e6d2ef4d73e533c3421ae8e24bd1487a8025603e06da3974512445ce6a3a038c1
SSDEEP

12288:/W1aCIB7LXu646OPViY4zK3giGOtlUMJ0lhYA32ovwDagRPJDTGfDiBmtgYFTq:+1aR89izzK3g/MNwhYezvwDXGfxtgM

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4828-132-0x0000000000400000-0x000000000058B000-memory.dmp	upx
behavioral2/memory/4828-134-0x0000000000400000-0x000000000058B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3160	4828	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1060	4828	04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe	82
PID 4828 wrote to memory of 1060	4828	04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe	82
PID 4828 wrote to memory of 1060	4828	04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe	82

C:\Users\Admin\AppData\Local\Temp\04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe
"C:\Users\Admin\AppData\Local\Temp\04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe
  C:\Users\Admin\AppData\Local\Temp\04f57eba118d002996864762d8aa1d84dfcf38ea3780c8c119092a0061bb0453.exe
  2⤵
  PID:1060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 480
  2⤵
  - Program crash
  PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4828 -ip 4828
1⤵
PID:744

memory/4828-132-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download
memory/4828-134-0x0000000000400000-0x000000000058B000-memory.dmp

Filesize
1.5MB

Download