e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890

Analysis

max time kernel
91s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 11:56

Target

e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890.exe
Size

73KB
MD5

faf395bda05881c85319f8319c8bad34
SHA1

4935b9d8643cd97ed3b8a2d64bd3880ff670e126
SHA256

e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890
SHA512

06c4ce81abafab4ed3ad648252e0bdd88bd5a5b307ffb6cdb6d5edb75c0ac2601da6dacf94d7f0fcc3d916368726069126e0b29bd4cc55c510089423a82f83b6
SSDEEP

1536:3cu+r5DoWiA18JoUdD/PIudkvSo2/Kjt1l/3yHJgZTBFwErUhcwpzWAGkvYE9O:Mpr9iA1AH/PQv2yj3lEdu+rE

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2844-132-0x0000000000400000-0x0000000000633000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
632	2844	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2844	e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890.exe
2844	e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890.exe
2844	e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890.exe
2844	e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890.exe

C:\Users\Admin\AppData\Local\Temp\e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890.exe
"C:\Users\Admin\AppData\Local\Temp\e3380305d4c264704c71beeff4f41859f303e222fe73b5cbffbb03a59ec60890.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 576
  2⤵
  - Program crash
  PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2844 -ip 2844
1⤵
PID:3516

memory/2844-132-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2844-133-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download
memory/2844-135-0x0000000000400000-0x0000000000633000-memory.dmp

Filesize
2.2MB

Download