48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb

Analysis

max time kernel
91s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 20:17

Target

48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb.exe
Size

2.0MB
MD5

0add0ec36c9d8afe9d376903dbcf66c0
SHA1

4e84bccb8d43ba5dc9c8d634e96a5a7095dde48d
SHA256

48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb
SHA512

30c6f008de53a624ecf09933f75271c868b09bcab2c74c9d14c2c23fa1b80367d63f62ec340358dc5a56e3e2436e39d379c53fd46557245d82da749cc35e470b
SSDEEP

24576:BcrYuZqBOgoz2kCxfAuI4LxpStYFBIFkjvqqADqMhNyLhSbpS76TdHBtXf9Nt+iV:Bcp5CPAr4V3jvAQ9SbpS76TnZ1V1Dz28

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
4624	48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbbmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0005000000022dbe-133.dat	upx
behavioral2/files/0x0005000000022dbe-134.dat	upx
behavioral2/memory/4624-136-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	4624	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4624	1776	48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb.exe	77
PID 1776 wrote to memory of 4624	1776	48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb.exe	77
PID 1776 wrote to memory of 4624	1776	48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb.exe	77

C:\Users\Admin\AppData\Local\Temp\48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb.exe
"C:\Users\Admin\AppData\Local\Temp\48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbbmgr.exe
  C:\Users\Admin\AppData\Local\Temp\48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbbmgr.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 264
    3⤵
    - Program crash
    PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4624 -ip 4624
1⤵
PID:536

C:\Users\Admin\AppData\Local\Temp\48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbbmgr.exe

Filesize
105KB

MD5
7ccc43bbc8030d8e9a77536bbf165273

SHA1
3b7db07d14c6067cc476f94a82b974dd04243ca7

SHA256
03dc1b0e8eab601aac009183a6dd39ea77d875b28c634ebe51fb60824333ddb2

SHA512
2c7a6f028ee422cef7fa0502b2140a7935dc511b0e280e6587f5ff717d25c9723eda9650f96628d29b367d883037312e2c918b7ad37fde1f364c76f8647cb81d

Download Submit
C:\Users\Admin\AppData\Local\Temp\48743744280b16c9ba2b420395cdaa3a0904b21c5b21980e4dcff9c0486f5bbbmgr.exe

Filesize
105KB

MD5
7ccc43bbc8030d8e9a77536bbf165273

SHA1
3b7db07d14c6067cc476f94a82b974dd04243ca7

SHA256
03dc1b0e8eab601aac009183a6dd39ea77d875b28c634ebe51fb60824333ddb2

SHA512
2c7a6f028ee422cef7fa0502b2140a7935dc511b0e280e6587f5ff717d25c9723eda9650f96628d29b367d883037312e2c918b7ad37fde1f364c76f8647cb81d

Download Submit
memory/1776-135-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/1776-137-0x0000000000400000-0x0000000000606000-memory.dmp

Filesize
2.0MB

Download
memory/4624-136-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download