79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170

Analysis

max time kernel
90s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:45

Target

79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe
Size

180KB
MD5

1487ebe0a2d5c231876f4daa54f01e4c
SHA1

e95fdbdc98cedcfd0ab855bcc7ef241130136d22
SHA256

79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170
SHA512

e14245df91f609d9b75cf2d2cd1006ffd2eb762683ec85f82bf97f0abdf8218c3c997744ba0cc9297cececaf63a1aea366cc64a90da45b9f7ff41885ca3d0923
SSDEEP

3072:cH+q+Q8wJno2lKiXNbb/gBXWXjZGMP+0eeydD8lg82XyAUvF:Zlw9ayCBXMjc0WDWtAUvF

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4956-132-0x0000000001000000-0x0000000001053000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1284 4956 WerFault.exe 79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe

pid	pid_target	process	target process
1284	4956	WerFault.exe	79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe

C:\Users\Admin\AppData\Local\Temp\79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe
"C:\Users\Admin\AppData\Local\Temp\79dc2eafc2ac046b8bdb821b469ffcd16d976c54f9b307de43ef9226c7d5a170.exe"
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 288
2⤵
- Program crash
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4956 -ip 4956
1⤵
PID:4824

memory/4956-132-0x0000000001000000-0x0000000001053000-memory.dmp

Filesize
332KB

Download