973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:07

Target

973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe
Size

311KB
MD5

35a6c83d341f178df35037c17b2c5b38
SHA1

49be98b46116143042d1b67c9a420d427b719fc1
SHA256

973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6
SHA512

4f0f2ab06ccd923628f25c3257a32044d44f0006c10d5483af91fd30d45c33cdd73850bd34e5e053206e43b745bc224e0bb406cdf6880475f828b23a4989267e
SSDEEP

6144:nk4jBDrwpAmmgUJOiMtS2xsA3BMj0lMGxaP+nvbYZRUhTR7R+G4y:nfjEiMtSBj0lMiaPgbWRSTf

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4964-132-0x0000000001000000-0x0000000001077000-memory.dmp	upx
behavioral2/memory/4964-133-0x0000000001000000-0x0000000001077000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2156 4964 WerFault.exe 973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe

pid	pid_target	process	target process
2156	4964	WerFault.exe	973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe

C:\Users\Admin\AppData\Local\Temp\973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe
"C:\Users\Admin\AppData\Local\Temp\973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe"
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 536
2⤵
- Program crash
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4964 -ip 4964
1⤵
PID:4500

memory/4964-132-0x0000000001000000-0x0000000001077000-memory.dmp

Filesize
476KB

Download
memory/4964-133-0x0000000001000000-0x0000000001077000-memory.dmp

Filesize
476KB

Download