7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66

Analysis

max time kernel
184s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 07:36

Target

7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66.exe
Size

132KB
MD5

35926bf52d7de0896a191b76186527e5
SHA1

5027eeb55a681f9964bf3c0a9ce0373e1167edc5
SHA256

7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66
SHA512

812a339090484d167ccfdfa40249055834f03ff52f4edac9c972aa979f1501f2e3436d0f59a33447aa59cf664ab56d5b7ff7d99fdffb97651b55133c495031a1
SSDEEP

1536:naMmKEB9SeVOkNV9qpAUY539HpWwmgNkww5lx50vLvEWgDAgvWSr:J29xzP53PWwnzelxXA8r

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3720-132-0x0000000000400000-0x0000000000494000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5116	3720	WerFault.exe	82
3400	3720	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 5116	3720	7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66.exe	84
PID 3720 wrote to memory of 5116	3720	7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66.exe	84
PID 3720 wrote to memory of 5116	3720	7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66.exe	84

C:\Users\Admin\AppData\Local\Temp\7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66.exe
"C:\Users\Admin\AppData\Local\Temp\7698cfd484916849b391f41398c6842523a36cefb1a7dd2fc036b901a8344d66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 220
  2⤵
  - Program crash
  PID:5116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 220
  2⤵
  - Program crash
  PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3720 -ip 3720
1⤵
PID:3228

memory/3720-132-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download