8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a

Analysis

max time kernel
236s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 01:30

Target

8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a.exe
Size

257KB
MD5

6089d7e840bf3fe2a3db8af14efd6a99
SHA1

1b19445681e5ab873a5fe9299de530a6547662fc
SHA256

8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a
SHA512

c8fc04724994ce74095e51b59d1fee20b520fc2b17b35d8ccf04e849cd25fcec51d2f8b27851e5c56af6b9a7812ccd33eece83d50092258047f6b3b28eb1fb1d
SSDEEP

3072:/wV4OgSzBmh04eZFkz3Rr0gwGj9Tf85otCh7PoDk5N4koH7LE:/MzzILGFkzhr0pGj9oJDoYJV

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/752-55-0x0000000000400000-0x0000000000481000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	752	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1488	752	8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a.exe	28
PID 752 wrote to memory of 1488	752	8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a.exe	28
PID 752 wrote to memory of 1488	752	8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a.exe	28
PID 752 wrote to memory of 1488	752	8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a.exe	28

C:\Users\Admin\AppData\Local\Temp\8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a.exe
"C:\Users\Admin\AppData\Local\Temp\8ea60d1c7bf6c93c19606a03e22f9d88082cfe545d40a81672e93280f274327a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 88
  2⤵
  - Program crash
  PID:1488

memory/752-55-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1488-54-0x0000000000000000-mapping.dmp

Download