82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe
Size

1.0MB
MD5

ac872848690f6ac0855d416070103b71
SHA1

f66c518d9b392d81298d98d66eedf371657b47a7
SHA256

82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50
SHA512

3cd46cafaf6de7bf51f76b85f598f0275f09bc244ae73e7e93b4b805aca1a18377322d2a8c228d7767bba4262c50d912d81c92c164f850adaf7d63c5bf3787f3
SSDEEP

24576:5PreR3P6JTx7DCElEBGVn839Y5we1lZyR655lvsOb2lKZD0drVKQ:NrQiJRBl0NC5woZTP0Vwwd

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4388-144-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-147-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-146-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-148-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-151-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-153-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-155-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-157-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-159-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-161-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-163-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-165-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-167-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-169-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-171-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-173-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-175-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-177-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-179-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-181-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-183-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-185-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-187-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-189-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-191-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/4388-195-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3216	4388	WerFault.exe	78
4784	4388	WerFault.exe	78

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
644	Process not Found
644	Process not Found

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4388	82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe
4388	82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe
4388	82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe
4388	82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe
4388	82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe

C:\Users\Admin\AppData\Local\Temp\82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe
"C:\Users\Admin\AppData\Local\Temp\82cb515e563c79100d97508249b1bb8e0856cebc4f9036618fa2b03a9e44af50.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1228
  2⤵
  - Program crash
  PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1228
  2⤵
  - Program crash
  PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4388 -ip 4388
1⤵
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4388 -ip 4388
1⤵
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4388-132-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-133-0x0000000002470000-0x00000000024C4000-memory.dmp

Filesize
336KB

Download
memory/4388-134-0x0000000000E30000-0x0000000000E41000-memory.dmp

Filesize
68KB

Download
memory/4388-135-0x0000000000980000-0x000000000098C000-memory.dmp

Filesize
48KB

Download
memory/4388-136-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-137-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-139-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-141-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-143-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-144-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-147-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-146-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-148-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-149-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-151-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-153-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-155-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-157-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-159-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-161-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-163-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-165-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-167-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-169-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-171-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-173-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-175-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-177-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-179-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-181-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-183-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-185-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-187-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-189-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-191-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/4388-192-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-193-0x0000000002470000-0x00000000024C4000-memory.dmp

Filesize
336KB

Download
memory/4388-194-0x0000000000400000-0x00000000006D2000-memory.dmp

Filesize
2.8MB

Download
memory/4388-195-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download