f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa

Analysis

max time kernel
45s
max time network
69s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 00:43

Target

f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe
Size

18.8MB
MD5

bf3a5b0b72ce3e7148a7c5f82c0b6285
SHA1

a63623ecb9c49a34ddd50badb45c42f23c295bdd
SHA256

f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa
SHA512

78df5eabc9da3d4cdc2717cdad1bd77daa33dbdce3f4fd00e11a4a2d0c699493fe2e7da693688d88953d58d33a2e9b460f184cea500ae5b59f23914920c7d1ec
SSDEEP

393216:g5q8dEVUEW+bzpcACMn18I9ueVQhn/t1NPhy+WwSCJtOsnWtSbWk:g5ym8FrC08aueVKn/t1FI+hSCJJc8Wk

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1380-55-0x0000000000400000-0x0000000003F5D000-memory.dmp	upx
behavioral1/memory/1380-56-0x0000000000400000-0x0000000003F5D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
652	1380	WerFault.exe	27

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe
1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe
1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe
1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe
1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 652	1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe	28
PID 1380 wrote to memory of 652	1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe	28
PID 1380 wrote to memory of 652	1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe	28
PID 1380 wrote to memory of 652	1380	f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe	28

C:\Users\Admin\AppData\Local\Temp\f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe
"C:\Users\Admin\AppData\Local\Temp\f19d801d44db5e3330fdcae5d7dafa6824f7fb99107e613e17f1a2ed4eaf80aa.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 688
  2⤵
  - Program crash
  PID:652

memory/1380-54-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1380-55-0x0000000000400000-0x0000000003F5D000-memory.dmp

Filesize
59.4MB

Download
memory/1380-56-0x0000000000400000-0x0000000003F5D000-memory.dmp

Filesize
59.4MB

Download