812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758

Analysis

max time kernel
152s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 22:19

Target

812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe
Size

82KB
MD5

41e3d7fac5c87f54e742ceb0d658556f
SHA1

0b83b3a80db525bc0c9d5188064ad354a9ee91cd
SHA256

812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758
SHA512

de3af1d05f57f74141b78db8712eb13050c055568f078b07e07d15a76a971708cd6273f8d64f49c44be52f33028963b04f48fe1a77467daa2e5033e39b9b6446
SSDEEP

1536:Y+xjS3Jjzt+hRnPzaNfQd7qjoq2DRJcqVIBH+nYoXzGaGlPjEmbK3LyQCh1DEhpV:Y+J8JYbPzaNACj2D+78GzJb8LyFzIz

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1964-132-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
852	1964	WerFault.exe	82
1256	1964	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 852	1964	812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe	85
PID 1964 wrote to memory of 852	1964	812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe	85
PID 1964 wrote to memory of 852	1964	812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe	85

C:\Users\Admin\AppData\Local\Temp\812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe
"C:\Users\Admin\AppData\Local\Temp\812bb4d87b9d7c718bf103efdb476430e05c1b51a7114654210b1783e1147758.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 284
  2⤵
  - Program crash
  PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 284
  2⤵
  - Program crash
  PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1964 -ip 1964
1⤵
PID:2952

memory/1964-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1964-133-0x0000000000580000-0x0000000000584000-memory.dmp

Filesize
16KB

Download