5c8643d7a04e26b0f694b4f28bf9f524526d18aa8e3c79000cb4c62d99208970

Analysis

max time kernel
163s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 04:10

Target

5c8643d7a04e26b0f694b4f28bf9f524526d18aa8e3c79000cb4c62d99208970.exe
Size

234KB
MD5

105194fca06e3722d7e5cc53645c0630
SHA1

75a3a21cfbc22e1b76d6500abce4e2b65cf714d2
SHA256

5c8643d7a04e26b0f694b4f28bf9f524526d18aa8e3c79000cb4c62d99208970
SHA512

c722c8f73a9a6d0f7692283f7e2643cc681333437c3ae3ef352e9634c34b0e1dfd680777d317d340d5139d3e774aef9bf0f160c1425305edfcb8af9f60ad36b4
SSDEEP

6144:2xV8dI3bxRETtXaz/OJepymej5viyT5O/q9DUGEyoSq:2n8dI3b7ETtKKepymejF5aeDUGNoSq

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1984-134-0x0000000000400000-0x00000000004DF000-memory.dmp	upx
behavioral2/memory/1984-136-0x0000000000400000-0x00000000004DF000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4260	1984	WerFault.exe	79

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1984	5c8643d7a04e26b0f694b4f28bf9f524526d18aa8e3c79000cb4c62d99208970.exe

C:\Users\Admin\AppData\Local\Temp\5c8643d7a04e26b0f694b4f28bf9f524526d18aa8e3c79000cb4c62d99208970.exe
"C:\Users\Admin\AppData\Local\Temp\5c8643d7a04e26b0f694b4f28bf9f524526d18aa8e3c79000cb4c62d99208970.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 468
  2⤵
  - Program crash
  PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1984 -ip 1984
1⤵
PID:876

memory/1984-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1984-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download