Overview

overview

8

Static

static

8

cfa81d5768...9f.exe

windows7-x64

8

cfa81d5768...9f.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 12:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    cfa81d576806a7c60f997deec887c5d30f8aca189d757eec9a05c29777a4819f.exe

  • Size

    289KB

  • MD5

    849179c144057dd362f9e58dd8173aad

  • SHA1

    ec711914ffcbc218da79f52ec325bcf7e74a49ba

  • SHA256

    cfa81d576806a7c60f997deec887c5d30f8aca189d757eec9a05c29777a4819f

  • SHA512

    f9fc70eb16396b93feb5b5eddf69dac77ab560343962afe041a2b8944e8fdf69a60dd0946bf27e9922e8b251e24b16532176edaf7c1d92b885db1f92d796e7ac

  • SSDEEP

    3072:dicL0cRBsQB80PFvWOgoHi2PxayGYF/LwrZCuhw4oSkrZ:YcLjsQf5goCCSVRwfvrZ

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfa81d576806a7c60f997deec887c5d30f8aca189d757eec9a05c29777a4819f.exe
    "C:\Users\Admin\AppData\Local\Temp\cfa81d576806a7c60f997deec887c5d30f8aca189d757eec9a05c29777a4819f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4792
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 248
      2⤵
      • Program crash
      PID:4188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 256
      2⤵
      • Program crash
      PID:2860
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4792 -ip 4792
    1⤵
      PID:3532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4792 -ip 4792
      1⤵
        PID:3160

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4792-132-0x0000000000F10000-0x0000000000F5A000-memory.dmp

              Filesize

              296KB

              Download