100aa5c76f5d80293f95aaf218629a98ddde45ffbb10ab6f3d6879b6439e1147

Analysis

max time kernel
21s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 13:15

Target

Trojan-Ransom.Win32.Birele.exe
Size

204KB
MD5

37da6617c1d20f41c16725ec44aad0c0
SHA1

07e46de3eda4543c9148d5a0dc4c4e302aaaa0d4
SHA256

100aa5c76f5d80293f95aaf218629a98ddde45ffbb10ab6f3d6879b6439e1147
SHA512

94356418dd9766b82ae887507844235872f499f27d4e81214a0b022a811d8b41215b68fff449405c7f2d33e99d081458b7fd82827cb7b4a616eb709cb68b1968
SSDEEP

6144:OS/ryv8fBS/ryv8fAYdS/ryv8fAYHS/ryv8fAY1:t/rC8fo/rC8fAYk/rC8fAYy/rC8fAY1

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/836-65-0x0000000000400000-0x0000000000447C00-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 1932	836	Trojan-Ransom.Win32.Birele.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	1932	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
836	Trojan-Ransom.Win32.Birele.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 836 wrote to memory of 1932	836	Trojan-Ransom.Win32.Birele.exe	27
PID 1932 wrote to memory of 1724	1932	Trojan-Ransom.Win32.Birele.exe	28
PID 1932 wrote to memory of 1724	1932	Trojan-Ransom.Win32.Birele.exe	28
PID 1932 wrote to memory of 1724	1932	Trojan-Ransom.Win32.Birele.exe	28
PID 1932 wrote to memory of 1724	1932	Trojan-Ransom.Win32.Birele.exe	28

memory/836-65-0x0000000000400000-0x0000000000447C00-memory.dmp

Filesize
287KB

Download
memory/1932-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1932-57-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download