83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:49

Target

83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe
Size

56KB
MD5

2c989d105bb6a48f0b129a544c72d3db
SHA1

2db15f13e32c5b056e4469ce6b161b455fd9f84b
SHA256

83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a
SHA512

3212841147d44bfb43dd0c53b07e257325846cdf6878ec69ed0ed7069d99f679fedb68e5fba07478567a2c2d1e49544519d8bf7bd805ce7a319f016021d92350
SSDEEP

768:i7VGsDZQVzeK9S/a+QcvrQlEoOcvlDYyRN83+6qHOrFG0zu9rS+jTho0wksML60p:4BZazGan0QnAyjC+6KO80urSIhoHM/

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2144-132-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/2144-134-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2584	2144	WerFault.exe	83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe
2240	2144	WerFault.exe	83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe

description	pid	process	target process
PID 2144 wrote to memory of 2584	2144	83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe	WerFault.exe
PID 2144 wrote to memory of 2584	2144	83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe	WerFault.exe
PID 2144 wrote to memory of 2584	2144	83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe
"C:\Users\Admin\AppData\Local\Temp\83a5d394ef787e040282d86a6dc4692ebc347fca32f8f120ed2ea4641876da8a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 292
  2⤵
  - Program crash
  PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 292
  2⤵
  - Program crash
  PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2144 -ip 2144
1⤵
PID:424

memory/2144-132-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2144-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-133-0x0000000000000000-mapping.dmp

Download