a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a

Analysis

max time kernel
27s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 02:18

Target

a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe
Size

229KB
MD5

7956ba6dd5c0b4023336881cbd9780bf
SHA1

4defd484ab8ef4c3b447a45fcfcb46970b891513
SHA256

a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a
SHA512

ef4131457ed0e1b5fb0c2179b9650b442e8c90ca5a0c9aa5bec40e975395c3ff18111cf86433443075ec7a5c11a0c5e3c1be4ae97495375173aab5ef031a3023
SSDEEP

6144:/xQ3vADurdYjNXztZlOHvIzim7EdensblEyaFTYt:SfADaW5tqRensb+zct

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1852-55-0x0000000000400000-0x000000000046A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1852	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1928	1852	a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe	28
PID 1852 wrote to memory of 1928	1852	a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe	28
PID 1852 wrote to memory of 1928	1852	a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe	28
PID 1852 wrote to memory of 1928	1852	a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe	28

C:\Users\Admin\AppData\Local\Temp\a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe
"C:\Users\Admin\AppData\Local\Temp\a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 128
  2⤵
  - Program crash
  PID:1928

memory/1852-55-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download