a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a

Analysis

max time kernel
146s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 02:18

Target

a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe
Size

229KB
MD5

7956ba6dd5c0b4023336881cbd9780bf
SHA1

4defd484ab8ef4c3b447a45fcfcb46970b891513
SHA256

a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a
SHA512

ef4131457ed0e1b5fb0c2179b9650b442e8c90ca5a0c9aa5bec40e975395c3ff18111cf86433443075ec7a5c11a0c5e3c1be4ae97495375173aab5ef031a3023
SSDEEP

6144:/xQ3vADurdYjNXztZlOHvIzim7EdensblEyaFTYt:SfADaW5tqRensb+zct

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3488-132-0x0000000000400000-0x000000000046A000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2740	3488	WerFault.exe	80
2200	3488	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2200	3488	a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe	84
PID 3488 wrote to memory of 2200	3488	a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe	84
PID 3488 wrote to memory of 2200	3488	a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe	84

C:\Users\Admin\AppData\Local\Temp\a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe
"C:\Users\Admin\AppData\Local\Temp\a28c8a8df1b2162a6c062707a3779c8a91ac9f8484ab86654b08b6ae13efce7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 396
  2⤵
  - Program crash
  PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 396
  2⤵
  - Program crash
  PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3488 -ip 3488
1⤵
PID:1216

memory/3488-132-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download