1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 18:01

Target

1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89.exe
Size

525KB
MD5

a3700036f937e1becef5073c66e823c6
SHA1

25c2d46de954d49f9a767fd2857c1d68f983b4a1
SHA256

1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89
SHA512

e9a767f03b147138efc92c0431aed423f14892d0842fe6c297b6b1b2550e7d744f61dd62ce1a33ccbd9d9b96a9b985219ea6757f4dbd2c8f45f500a87dc50288
SSDEEP

12288:UhRwctdaumW9fkQngna8YMmlUbzDCFC2PQKoSiSsPdH:Uh6cX/ZWa+nD0PQXSo5

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1112-56-0x0000000000400000-0x00000000005BF000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1112	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1928	1112	1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89.exe	28
PID 1112 wrote to memory of 1928	1112	1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89.exe	28
PID 1112 wrote to memory of 1928	1112	1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89.exe	28
PID 1112 wrote to memory of 1928	1112	1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89.exe	28

C:\Users\Admin\AppData\Local\Temp\1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89.exe
"C:\Users\Admin\AppData\Local\Temp\1b39e9aae314411a7d83387d28abe24a9c443142fb02f2c98075e84d98b32f89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 180
  2⤵
  - Program crash
  PID:1928

memory/1112-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1112-56-0x0000000000400000-0x00000000005BF000-memory.dmp

Filesize
1.7MB

Download