c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 21:46

Target

c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c.exe
Size

54KB
MD5

9204c4b25c1a2c35e1d46d6cc3cde8b0
SHA1

959d00e82226f4ede3e2ce354a5a71ebeed229cb
SHA256

c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c
SHA512

6fdbae026bfe3be21e6618d0b1b36bdbb3a88af9338141d5b1ccd12788e0ccdd9ad1912eaa2daa2cf65bd50c3593845f6da02490db3dcd9c5aa5e5c786562cbe
SSDEEP

768:2ea3/Ln9fn89rQxtUwLYLrHGbzCH7nUKfiVIVXAt2rh1usAea8kIRfQK1UdManHv:2eyDn9nZUMoBUw/wt2gxefQKamaHjL

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1584-55-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	1584	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1772	1584	c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c.exe	26
PID 1584 wrote to memory of 1772	1584	c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c.exe	26
PID 1584 wrote to memory of 1772	1584	c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c.exe	26
PID 1584 wrote to memory of 1772	1584	c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c.exe	26

C:\Users\Admin\AppData\Local\Temp\c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c.exe
"C:\Users\Admin\AppData\Local\Temp\c34ab1ff49fe56719c223462c5e65049231567a5f919728b35edc2211cfc321c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 168
  2⤵
  - Program crash
  PID:1772

memory/1584-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1584-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download