0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad

Analysis

max time kernel
101s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:57

Target

0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe
Size

57KB
MD5

35d29ed4bf94a2623fc8e86e7e5bfb7c
SHA1

db2d1e4553917c4eed8dc1af51a91017a66a84f2
SHA256

0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad
SHA512

56f06027a23557ffaaf5bf99e9cbf861d779305d25eb73ef00e9b3da0828f62b59350149f2158168182db2c91bbc48b23abe7e5252fd0d5ba1ed1b1a284ef628
SSDEEP

1536:q8zwwn0vmFaiTk5NHwtG+RfkTX8TWL5VbEPL:Lwwn0vmFaioQYgfRTG/bEL

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/560-54-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/560-56-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1632 560 WerFault.exe 0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe

pid	pid_target	process	target process
1632	560	WerFault.exe	0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe

description	pid	process	target process
PID 560 wrote to memory of 1632	560	0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe	WerFault.exe
PID 560 wrote to memory of 1632	560	0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe	WerFault.exe
PID 560 wrote to memory of 1632	560	0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe	WerFault.exe
PID 560 wrote to memory of 1632	560	0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe
"C:\Users\Admin\AppData\Local\Temp\0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 148
2⤵
- Program crash
PID:1632

memory/560-54-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/560-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1632-55-0x0000000000000000-mapping.dmp

Download