249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766

Analysis

max time kernel
174s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:31

Target

249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe
Size

813KB
MD5

a82b5a3878afc0cc0f339424cd39daf9
SHA1

43e2aa0072eef60a6261ee2b4455637bfe857444
SHA256

249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766
SHA512

d21930e1d6019af4f2850779b980b429edc66ffda7f37d7fb468eedeac9c8851f078041f268eaf4424739357c7259046ecff2798c177ae2284ef04c72ef6465c
SSDEEP

12288:rN2YioqA70wC6qtf3m8FutpPfKTMpIS+ph6AzKygyTpdhJw6MBgZBQ8kVNcu:Y0qA7Gm8FuXf3pIS+d6kGUBQ8V

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4720-132-0x0000000000400000-0x00000000007B0000-memory.dmp	upx
behavioral2/memory/4720-133-0x0000000000400000-0x00000000007B0000-memory.dmp	upx
behavioral2/memory/4720-134-0x0000000000400000-0x00000000007B0000-memory.dmp	upx

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
400	4720	WerFault.exe	249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe
2748	4720	WerFault.exe	249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe

description	pid	process	target process
PID 4720 wrote to memory of 400	4720	249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe	WerFault.exe
PID 4720 wrote to memory of 400	4720	249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe	WerFault.exe
PID 4720 wrote to memory of 400	4720	249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe
"C:\Users\Admin\AppData\Local\Temp\249cc9266aef91567f39cc71e6d1db73347cac9ec6f2aa95e2e4fc5c64a1f766.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 532
2⤵
- Program crash
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 532
2⤵
- Program crash
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4720 -ip 4720
1⤵
PID:176

memory/400-135-0x0000000000000000-mapping.dmp

Download
memory/4720-132-0x0000000000400000-0x00000000007B0000-memory.dmp

Filesize
3.7MB

Download
memory/4720-133-0x0000000000400000-0x00000000007B0000-memory.dmp

Filesize
3.7MB

Download
memory/4720-134-0x0000000000400000-0x00000000007B0000-memory.dmp

Filesize
3.7MB

Download