a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84

Analysis

max time kernel
292s
max time network
368s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:53

Target

a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe
Size

109KB
MD5

5136003f12ee4676b47c4c902c495200
SHA1

7f596e40832b6855ec156ae2170529700d8dcdb2
SHA256

a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84
SHA512

6f4f2fd0b4ec5ab927257cdfad1f50d0c5652a229e1a7bf14c11cc49e1025f982324e75003543fd9ce8b27da3da71478ac89ec2a9971e2c5f220442584a45b01
SSDEEP

1536:sLOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9Tf8:YwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1340-132-0x0000000000400000-0x0000000000456000-memory.dmp	upx

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4812	1340	WerFault.exe	a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe
4700	1340	WerFault.exe	a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe

description	pid	process	target process
PID 1340 wrote to memory of 4812	1340	a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe	WerFault.exe
PID 1340 wrote to memory of 4812	1340	a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe	WerFault.exe
PID 1340 wrote to memory of 4812	1340	a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe
"C:\Users\Admin\AppData\Local\Temp\a0e7a684f59ea105af6052414ce26b37e539eb015197f877e03ca311a2fd9e84.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 264
2⤵
- Program crash
PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 264
2⤵
- Program crash
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1340 -ip 1340
1⤵
PID:2892

memory/1340-132-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4812-133-0x0000000000000000-mapping.dmp

Download