c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:10 UTC

Target

c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1.exe
Size

14KB
MD5

37f4d7b41c89ae41feb357a4cfbcd110
SHA1

681aae8925ae73d648dd6db2fae3c8bf5c61a114
SHA256

c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1
SHA512

305392e65fa34c10ec58b91deaa7a665adbffc660a8b063542c549177733fe59d5df0f12f59158250685db2e8df8bad30dcbfbef12ec9c8367c558d3b84e6c96
SSDEEP

384:AQinGlV5lRwaM9IV3wag7YjIRV4mn29xMyj:Ad2gab2V4mnA2u

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1632-55-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	1632	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1124	1632	c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1.exe	28
PID 1632 wrote to memory of 1124	1632	c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1.exe	28
PID 1632 wrote to memory of 1124	1632	c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1.exe	28
PID 1632 wrote to memory of 1124	1632	c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1.exe	28

C:\Users\Admin\AppData\Local\Temp\c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1.exe
"C:\Users\Admin\AppData\Local\Temp\c586d1deea211fcbdcfc54634cbd8b473ac0d42975872d858b22b300031aa3b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 88
  2⤵
  - Program crash
  PID:1124

memory/1632-55-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download