4045e6d78da5af456e113334773b2f4f139acef761db024f7341f1457a7d2533

Analysis

max time kernel
195s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:53

Target

4045e6d78da5af456e113334773b2f4f139acef761db024f7341f1457a7d2533.exe
Size

21KB
MD5

abfd967a971e03b3120df854d7d473dd
SHA1

dd4a43f91213f1fe7565bded41cfd67686d56676
SHA256

4045e6d78da5af456e113334773b2f4f139acef761db024f7341f1457a7d2533
SHA512

aa0445e95a3dcb25e08bb8715da46c312dfc8884f7af6dc5db7930dd5837dfff72a9825d621393c07cda1998efa7266a139f23f1421811ce093614e04ed99d3c
SSDEEP

384:6YDU1WvtOcAODk0RJs/d29qayninoSi57ADtAZ+rZbkyZIWcCoy:6GUmtBAyJcLinohstAMlrWWR

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2452-132-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/2452-133-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3048 2452 WerFault.exe 4045e6d78da5af456e113334773b2f4f139acef761db024f7341f1457a7d2533.exe

pid	pid_target	process	target process
3048	2452	WerFault.exe	4045e6d78da5af456e113334773b2f4f139acef761db024f7341f1457a7d2533.exe

C:\Users\Admin\AppData\Local\Temp\4045e6d78da5af456e113334773b2f4f139acef761db024f7341f1457a7d2533.exe
"C:\Users\Admin\AppData\Local\Temp\4045e6d78da5af456e113334773b2f4f139acef761db024f7341f1457a7d2533.exe"
1⤵
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 284
2⤵
- Program crash
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2452 -ip 2452
1⤵
PID:1796

memory/2452-132-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2452-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download