caf83d3836874e2ce857bfd0d53157d354897fda8270958e5d12ecaa33538c87

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 13:14

Target

caf83d3836874e2ce857bfd0d53157d354897fda8270958e5d12ecaa33538c87.exe
Size

99KB
MD5

e56945b1324f7d9bf064774653d8b625
SHA1

402dd0738ebc776de0e220e5f1ccb26ccf2cac30
SHA256

caf83d3836874e2ce857bfd0d53157d354897fda8270958e5d12ecaa33538c87
SHA512

52e90cc567bfff4985ecbb5ab73e2d6b5df993fa1adc46f47dfdb11ecfbc606c8299c647e5bae5925852456a9574396e2bac6b74cb52c7ac241a48e8c73b6a4b
SSDEEP

3072:Qwi089AvUB1LZPE1AAQvCTjE/j15AY41C:c0wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4816-132-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	4816	WerFault.exe	79

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4816	caf83d3836874e2ce857bfd0d53157d354897fda8270958e5d12ecaa33538c87.exe

C:\Users\Admin\AppData\Local\Temp\caf83d3836874e2ce857bfd0d53157d354897fda8270958e5d12ecaa33538c87.exe
"C:\Users\Admin\AppData\Local\Temp\caf83d3836874e2ce857bfd0d53157d354897fda8270958e5d12ecaa33538c87.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 728
  2⤵
  - Program crash
  PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4816 -ip 4816
1⤵
PID:4984

memory/4816-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4816-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4816-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download