6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce

Analysis

max time kernel
155s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 17:17

Target

6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce.exe
Size

201KB
MD5

02b6dc36893732460cf2f55488923ac7
SHA1

64f03b89a7d3764c07571f72a82c2717a6328a89
SHA256

6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce
SHA512

eacf50e87949380b14afd5bc17d0910841eb0d5c23018bbf7fdf821c5a492f805647530d52b1304d1c46ebba43face52c9f8a0ea9619408090df60cfe8b830a5
SSDEEP

6144:OxWCm+/c7R8Hm2ruenD78CtcBRVXhmrPTl:TMU7R8BRDA0cB3hmN

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4420-132-0x0000000001000000-0x000000000105B000-memory.dmp	upx
behavioral2/memory/4420-134-0x0000000001000000-0x000000000105B000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2488	4420	WerFault.exe	75
928	4420	WerFault.exe	75

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 2488	4420	6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce.exe	79
PID 4420 wrote to memory of 2488	4420	6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce.exe	79
PID 4420 wrote to memory of 2488	4420	6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce.exe	79

C:\Users\Admin\AppData\Local\Temp\6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce.exe
"C:\Users\Admin\AppData\Local\Temp\6f6ba81f25ca1d2212d6fca6088efe944b0526bc848f961db83274873b78d6ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 260
  2⤵
  - Program crash
  PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 260
  2⤵
  - Program crash
  PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4420 -ip 4420
1⤵
PID:1220

memory/4420-132-0x0000000001000000-0x000000000105B000-memory.dmp

Filesize
364KB

Download
memory/4420-134-0x0000000001000000-0x000000000105B000-memory.dmp

Filesize
364KB

Download