77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca

Analysis

max time kernel
19s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 16:55

Target

77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca.exe
Size

67KB
MD5

8425fd58f6af644bf1587af1abbea510
SHA1

f7bb1e113fb031da62ab33f1efea572c9563b04a
SHA256

77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca
SHA512

bfb84ad86a3b07a1230309d6c4d5c40bf2fc43f6d63240d4b2f2500469b3a129415f8c89d129f7bab568f320d5d4663b92bb5a39c2d049fe691cb6390fc1c60d
SSDEEP

1536:LvhyljZ3YVPt5Ku8v5ie32e3eww09sWB:LvklF3WPYv5isn3PwRA

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/864-54-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/864-56-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	864	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1608	864	77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca.exe	28
PID 864 wrote to memory of 1608	864	77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca.exe	28
PID 864 wrote to memory of 1608	864	77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca.exe	28
PID 864 wrote to memory of 1608	864	77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca.exe	28

C:\Users\Admin\AppData\Local\Temp\77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca.exe
"C:\Users\Admin\AppData\Local\Temp\77f7b9eb9a3eef1d8b0ec770a2305b8ccb7c9ca15690c120b053fdb31d390fca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 96
  2⤵
  - Program crash
  PID:1608

memory/864-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/864-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download