4d18734b0832e0cf91fdf3176fabf2a8344912a979d66066a14cdddd82036212

Analysis

max time kernel
201s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:13

Target

4d18734b0832e0cf91fdf3176fabf2a8344912a979d66066a14cdddd82036212.exe
Size

175KB
MD5

4478d63bfa4ba7eedfbbdbb01e675286
SHA1

c90eaec956002d5ddfcd7b2ce0510ee93fad8290
SHA256

4d18734b0832e0cf91fdf3176fabf2a8344912a979d66066a14cdddd82036212
SHA512

995b0da360ba473fa77a2d5d532e96f336c0987392e0af8e3f745a6dcc1924246d7f95500b1ad91655b72a70acab16a4ba2a3ed399de56c1e23302d48f412369
SSDEEP

3072:JYNQKPWDyaRefVJltZrpRl1P3KflMPp8GvYLT3V7qlqL8jGOQpIPpnt+HT5WQ8Ai:yNSDyaRO1thpMflMPS1TVmML8jBQWVY8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4948-132-0x0000000001000000-0x0000000001055000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2468 4948 WerFault.exe 4d18734b0832e0cf91fdf3176fabf2a8344912a979d66066a14cdddd82036212.exe

pid	pid_target	process	target process
2468	4948	WerFault.exe	4d18734b0832e0cf91fdf3176fabf2a8344912a979d66066a14cdddd82036212.exe

C:\Users\Admin\AppData\Local\Temp\4d18734b0832e0cf91fdf3176fabf2a8344912a979d66066a14cdddd82036212.exe
"C:\Users\Admin\AppData\Local\Temp\4d18734b0832e0cf91fdf3176fabf2a8344912a979d66066a14cdddd82036212.exe"
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 496
2⤵
- Program crash
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4948 -ip 4948
1⤵
PID:1020

memory/4948-132-0x0000000001000000-0x0000000001055000-memory.dmp

Filesize
340KB

Download