032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:11

Target

032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe
Size

132KB
MD5

74bdf3ee2c5face0e630ac3b8374cca9
SHA1

75196c22727bd2583ae1ff1aeb2508ad34426783
SHA256

032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9
SHA512

3417dcee3b4c3c245c0a30f66ee30be979d22a0a91d79cf497eb8a2cd4ab8f14915d801b223aaa7d3584e0ba57cffce39e0006c1031d4bedf02cfa2764b77119
SSDEEP

3072:mwW6Aj+N0dEXKsJ4s9khUIm7SzEt/oYyk5DlObQZz7/COGcI:mwPN0O6kiWbNoYh96QZfCO7I

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/240-55-0x0000000000400000-0x000000000044C000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

992 240 WerFault.exe 032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe

pid	pid_target	process	target process
992	240	WerFault.exe	032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe

description	pid	process	target process
PID 240 wrote to memory of 992	240	032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe	WerFault.exe
PID 240 wrote to memory of 992	240	032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe	WerFault.exe
PID 240 wrote to memory of 992	240	032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe	WerFault.exe
PID 240 wrote to memory of 992	240	032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe
"C:\Users\Admin\AppData\Local\Temp\032690fdfb94aa98539e6433dc587e4607ecd57826ef4ba3a2edcfe49e18f5d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 152
2⤵
- Program crash
PID:992

memory/240-55-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/992-54-0x0000000000000000-mapping.dmp

Download