0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 11:20

Target

0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe
Size

1.2MB
MD5

117fce8252a4ef54e0c95bc213d7cc50
SHA1

73260e29b084116905014928362ab7570764d2bc
SHA256

0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9
SHA512

ee9c0080dea4d2b537d9cba701f9fb13306484812cd240a54eaca0c6c9befd7ef105823f481aac89cb1efa272b67733af64fa3dcd2b3e12c5420fd7c3a97d0e7
SSDEEP

24576:Rvxf9NfXB5klHwHYHD0zNCjllc+TKA5m1lcat0k6z3:RtOH6QjllVH5mcpk6T

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2552	0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0007000000022e36-134.dat	upx
behavioral2/files/0x0007000000022e36-133.dat	upx
behavioral2/memory/2552-136-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	2552	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 2552	4288	0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe	85
PID 4288 wrote to memory of 2552	4288	0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe	85
PID 4288 wrote to memory of 2552	4288	0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe	85

C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe
"C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe
  C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 260
    3⤵
    - Program crash
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2552 -ip 2552
1⤵
PID:2624

C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe

Filesize
99KB

MD5
f57eee1185dee33198b752dd1f66ad55

SHA1
b60f88d65f8805bf2ca095ecd1727b15eed4ff12

SHA256
6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

SHA512
cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

Download Submit
C:\Users\Admin\AppData\Local\Temp\0859aa914198a42e043f47218368a7f10dac75eae1e19a572e733e6f1f8c41d9mgr.exe

Filesize
99KB

MD5
f57eee1185dee33198b752dd1f66ad55

SHA1
b60f88d65f8805bf2ca095ecd1727b15eed4ff12

SHA256
6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

SHA512
cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

Download Submit
memory/2552-136-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4288-135-0x00000000006E0000-0x0000000000821000-memory.dmp

Filesize
1.3MB

Download
memory/4288-137-0x00000000006E0000-0x0000000000821000-memory.dmp

Filesize
1.3MB

Download