cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:47

Target

cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe
Size

337KB
MD5

083b977ad81ff82158cffa7c35416658
SHA1

d83862114df369a1a5a0c4c497980d6b2f64a529
SHA256

cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38
SHA512

3682e62c344b8278110b5452912aed8fada3dbc40af52a38872e1ec6b550b480ece1686b801a6214101b27790b6b1a03bfe527aaefad23adfc565a5537f68810
SSDEEP

6144:AggcT/LAARrZxYKmBSH2dxJOR8ghuinEFHOgZonaN3:VgcDL9ZsV9vJWhVnhc5R

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4884-135-0x00000000028A0000-0x00000000028AE000-memory.dmp	upx
behavioral2/memory/4884-137-0x00000000028A0000-0x00000000028AE000-memory.dmp	upx
behavioral2/memory/4884-141-0x00000000028A0000-0x00000000028AE000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
4884	cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	4884	WerFault.exe	82

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe
4884	cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe

C:\Users\Admin\AppData\Local\Temp\cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe
"C:\Users\Admin\AppData\Local\Temp\cb9cf83de18777f09316679851622e8c243858f25c1bea1dbf5bcd0ca570cc38.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 884
  2⤵
  - Program crash
  PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4884 -ip 4884
1⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\libnspr4.dll

Filesize
10KB

MD5
28a57355d9583b66e51ad978384c159e

SHA1
b8fe4ddb6187cdee0e89c02bab4a104f406d16da

SHA256
81ed76156df0de1caae6730a091f29978493881b54a2d6fbfb43c47153b6fadd

SHA512
991a288ed0f033eb8f54e567a6264a6111f795bd61a1cd600e210730d7ed39c89e735480dc6f0e4026eafad730ae8dc23ec7bc7600a14a2ac9d652638c02ee3e

Download Submit
memory/4884-132-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4884-133-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download
memory/4884-135-0x00000000028A0000-0x00000000028AE000-memory.dmp

Filesize
56KB

Download
memory/4884-136-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download
memory/4884-137-0x00000000028A0000-0x00000000028AE000-memory.dmp

Filesize
56KB

Download
memory/4884-139-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4884-140-0x00000000010C0000-0x00000000010CA000-memory.dmp

Filesize
40KB

Download
memory/4884-141-0x00000000028A0000-0x00000000028AE000-memory.dmp

Filesize
56KB

Download