769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855

Analysis

max time kernel
3s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:33

Target

769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855.exe
Size

350KB
MD5

c92ae5968728c89ee768c890d6c7036c
SHA1

e35c643ab2e5b5cb6824126a7fbdc8dab2f77eaa
SHA256

769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855
SHA512

eed1afc0f4f6adcba56134705d1acabe193e83901802869f34e52d58eb72f4a85400bc43d355436593184a11171fa920d5c05615d169a9521163428ce8746e8b
SSDEEP

6144:V0SOUUWLdVzJE0KQmwuAsaKByqG0Ogj1+lR1J4QZFO5:aSOXW7zrKQvu2b21+L16Qba

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1948-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	1948	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 960	1948	769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855.exe	28
PID 1948 wrote to memory of 960	1948	769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855.exe	28
PID 1948 wrote to memory of 960	1948	769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855.exe	28
PID 1948 wrote to memory of 960	1948	769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855.exe	28

C:\Users\Admin\AppData\Local\Temp\769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855.exe
"C:\Users\Admin\AppData\Local\Temp\769ff415c403bc21af86adca8049ada30d69e184463b351d2c6788796fe75855.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 204
  2⤵
  - Program crash
  PID:960

memory/1948-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1948-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download