57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6

Analysis

max time kernel
22s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:41

Target

57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6.exe
Size

104KB
MD5

0ccef4347c8dfe477efedaa9abcdaa34
SHA1

0e52c9069a2e4b1e0eb53d3c5e395baa32a0bef1
SHA256

57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6
SHA512

ce2a6d845d20c8fca93db411b0d2b0951fb4c56052d439ada96ed6a7a9291415fcf31f7b420652381482178b9f21e6b60c5a2a288d54b7da0f2b2c80d78910d3
SSDEEP

1536:ZaMmKEB9SeVOkNV9qpAUY539HpWwmgNkww5lx5jvLvEWgDAgvWSrk:D29xzP53PWwnzelxiA8rk

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1072-55-0x0000000000400000-0x0000000000468000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
304	1072	WerFault.exe	24

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 304	1072	57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6.exe	27
PID 1072 wrote to memory of 304	1072	57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6.exe	27
PID 1072 wrote to memory of 304	1072	57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6.exe	27
PID 1072 wrote to memory of 304	1072	57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6.exe	27

C:\Users\Admin\AppData\Local\Temp\57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6.exe
"C:\Users\Admin\AppData\Local\Temp\57bcf92352fa3679d4b2d335231807346fa9366103618c089130d95b3198b7a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 36
  2⤵
  - Program crash
  PID:304

memory/1072-55-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download