c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 08:07

Target

c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe
Size

396KB
MD5

c82082b628a6beffa13d56b426933fdb
SHA1

f13d01070b1add3120091706ae3c2f19302074ff
SHA256

c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c
SHA512

3ea3e6f1554ab0b8f0824206b02c2f02e55deb9b60d6bedb93f7792fb79cf65e0732bd2d4544324e7caa1e3cd0983633e3b1c4a39fd836552cdaf543a337072f
SSDEEP

12288:akFZl18+2NQ0AKjmvg4gJSCAkYKooopcKx:aI8+2kKjmv/CAkHhopc

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4904-132-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral2/memory/3364-138-0x0000000000540000-0x000000000058F000-memory.dmp	upx
behavioral2/memory/4904-139-0x0000000000400000-0x0000000000489000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe

description	pid	process	target process
PID 4904 set thread context of 3364	4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3748 3364 WerFault.exe svchost.exe

pid	pid_target	process	target process
3748	3364	WerFault.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe

pid	process
4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe
4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe

pid	process
4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe
4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe

description	pid	process	target process
PID 4904 wrote to memory of 3364	4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe	svchost.exe
PID 4904 wrote to memory of 3364	4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe	svchost.exe
PID 4904 wrote to memory of 3364	4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe	svchost.exe
PID 4904 wrote to memory of 3364	4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe	svchost.exe
PID 4904 wrote to memory of 3364	4904	c7253cf8af005780b347c6638e901c01ecb3ac1dbb53775add5e10c30e5e9c8c.exe	svchost.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 12
3⤵
- Program crash
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3364 -ip 3364
1⤵
PID:1676

memory/3364-137-0x0000000000000000-mapping.dmp

Download
memory/3364-138-0x0000000000540000-0x000000000058F000-memory.dmp

Filesize
316KB

Download
memory/4904-132-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4904-133-0x0000000010000000-0x0000000010043000-memory.dmp

Filesize
268KB

Download
memory/4904-139-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download