0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad

Analysis

max time kernel
182s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:57

Target

0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe
Size

57KB
MD5

35d29ed4bf94a2623fc8e86e7e5bfb7c
SHA1

db2d1e4553917c4eed8dc1af51a91017a66a84f2
SHA256

0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad
SHA512

56f06027a23557ffaaf5bf99e9cbf861d779305d25eb73ef00e9b3da0828f62b59350149f2158168182db2c91bbc48b23abe7e5252fd0d5ba1ed1b1a284ef628
SSDEEP

1536:q8zwwn0vmFaiTk5NHwtG+RfkTX8TWL5VbEPL:Lwwn0vmFaioQYgfRTG/bEL

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3664-132-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral2/memory/3664-133-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1620 3664 WerFault.exe 0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe

pid	pid_target	process	target process
1620	3664	WerFault.exe	0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe

C:\Users\Admin\AppData\Local\Temp\0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe
"C:\Users\Admin\AppData\Local\Temp\0c0aa5283e72662617b2bf431d50870f8b7521ce8412ff164d2b40ca9a0569ad.exe"
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 408
2⤵
- Program crash
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3664 -ip 3664
1⤵
PID:4860

memory/3664-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3664-133-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download