4297b8106271b931a099143ecd0cda006ac6ec8adcf348271247ca90e0f920f5

Analysis

max time kernel
138s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 13:23

Target

4297b8106271b931a099143ecd0cda006ac6ec8adcf348271247ca90e0f920f5.exe
Size

81KB
MD5

c9807694c3ec9c274662ab0930914a0e
SHA1

0f99d533c079ba7523d4d3435b61293fd2a26b94
SHA256

4297b8106271b931a099143ecd0cda006ac6ec8adcf348271247ca90e0f920f5
SHA512

38e55f355c88f484550449394ff239032733e321119d55caeb039e0813c749e46c554f7386715c8bcf6b17a04c91ed37ac7c3cb7b0caf7c285a68b8df0de184d
SSDEEP

1536:Ji+ztCr803D+qdy9xCcCThD0xrU5Pcx3zz748ptyi9SO/XIlC:JdEqvLETyxwtEb48pomSOwc

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1684-132-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4820	1684	WerFault.exe	78

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	4297b8106271b931a099143ecd0cda006ac6ec8adcf348271247ca90e0f920f5.exe

C:\Users\Admin\AppData\Local\Temp\4297b8106271b931a099143ecd0cda006ac6ec8adcf348271247ca90e0f920f5.exe
"C:\Users\Admin\AppData\Local\Temp\4297b8106271b931a099143ecd0cda006ac6ec8adcf348271247ca90e0f920f5.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 708
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1684 -ip 1684
1⤵
PID:4148

memory/1684-132-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1684-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1684-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download