3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d

Analysis

max time kernel
163s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 09:48

Target

3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe
Size

255KB
MD5

a81ccfe04de602a6fa894e36d39a6b7c
SHA1

fd85a0e31f2380e369456b25bea0dd527770bf84
SHA256

3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d
SHA512

e56d072a3448d1511cf864141e9a802f387ea4724d4b2f8d900df1647e72ef154ca0c64c15c446298adc7141887aa4ce721ef4fb7a8640efb58ef2ef722d0b81
SSDEEP

6144:WnYKiLAvXHD7McozLTDsE1A2j7n5GWDEpUTFBc9OYOg1R0tv:LwvHnMTzLTDsE62PQWDEpUc9OGWtv

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3440-134-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3440-135-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx
behavioral2/memory/3440-136-0x0000000000C80000-0x0000000000C96000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 824 set thread context of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3592	3440	WerFault.exe	80

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80
PID 824 wrote to memory of 3440	824	3678900fd83eb0a3106a3a8a6ddcb21172da700f3a506dfa133fe40bb2f1893d.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3440 -ip 3440
1⤵
PID:4384

memory/824-132-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/824-138-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3440-134-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3440-135-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download
memory/3440-136-0x0000000000C80000-0x0000000000C96000-memory.dmp

Filesize
88KB

Download