91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 00:47

Target

91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424.exe
Size

111KB
MD5

9e9e10c47b14215b62d7a93fe91d9545
SHA1

9bba75e62acfd433a82d627e107bd6c4c1101192
SHA256

91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424
SHA512

51b2024fb43b3faf9f91fe5ab59ec87ee26df74e7401be6fac8010e0d38d7eebf22b75d2f501a288316f6a2b21f333224fa06db1ea7c23602d57cf7f25702a9b
SSDEEP

3072:9/+MJKrUnFYY5z1i0Nmbi5fJBNPhkout:VIrPj0NmWtNyoS

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1784-56-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	1784	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1944	1784	91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424.exe	28
PID 1784 wrote to memory of 1944	1784	91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424.exe	28
PID 1784 wrote to memory of 1944	1784	91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424.exe	28
PID 1784 wrote to memory of 1944	1784	91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424.exe	28

C:\Users\Admin\AppData\Local\Temp\91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424.exe
"C:\Users\Admin\AppData\Local\Temp\91a1f7951f54fd91b60be8a972461a3fded7c4c18544390d4e1060b9b264c424.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 204
  2⤵
  - Program crash
  PID:1944

memory/1784-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1784-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download