601cf59bd1af81089bd4169917c560a3b3b85d50922144e5a7bd942a61297a58

Analysis

max time kernel
168s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:10

Target

601cf59bd1af81089bd4169917c560a3b3b85d50922144e5a7bd942a61297a58.exe
Size

155KB
MD5

06c38dc05547393ce77831f196f07ab3
SHA1

88ada0115968a84e0c93d1947b8ae4ad1d2f5b73
SHA256

601cf59bd1af81089bd4169917c560a3b3b85d50922144e5a7bd942a61297a58
SHA512

c27b46b867d1609544b835aebbced9531de57dd93b8bcaaa31bb86ad8383498362f91b2ec7a3276790352e0f997c80852888a956ae78976c6cc09b720728cfbd
SSDEEP

3072:zpKcz7xKVnW/Dx6+n9hbTcGMaIAX7W0TAMvkfr9dIXENKttj:zp/7V6qXFMaIATQT9dmEI

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5044-132-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

228 5044 WerFault.exe 601cf59bd1af81089bd4169917c560a3b3b85d50922144e5a7bd942a61297a58.exe

pid	pid_target	process	target process
228	5044	WerFault.exe	601cf59bd1af81089bd4169917c560a3b3b85d50922144e5a7bd942a61297a58.exe

C:\Users\Admin\AppData\Local\Temp\601cf59bd1af81089bd4169917c560a3b3b85d50922144e5a7bd942a61297a58.exe
"C:\Users\Admin\AppData\Local\Temp\601cf59bd1af81089bd4169917c560a3b3b85d50922144e5a7bd942a61297a58.exe"
1⤵
PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 224
  2⤵
  - Program crash
  PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5044 -ip 5044
1⤵
PID:1748

memory/5044-132-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5044-133-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download