bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35

Analysis

max time kernel
30s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 18:27

Target

bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35.exe
Size

67KB
MD5

6e10678e452a3a5d2b7ed1a0ea49b4d0
SHA1

f2f979240164f83ba3c2d03465f13911c33d9f9c
SHA256

bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35
SHA512

536998ae51b537f434cbe90d7907202c92edb364e836579971c5d1891f87410ef90bca4a96505691635c5237ee6ccc920cc7a79af945e4c27103ad796318d3e1
SSDEEP

1536:8KTU4eVd1oMHc909jptnPGYqihlS24IRStEgfZpj3/2MLjw:lY7VLpI01tnDqi2uRafHLuMLjw

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1556-55-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1556	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1756	1556	bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35.exe	27
PID 1556 wrote to memory of 1756	1556	bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35.exe	27
PID 1556 wrote to memory of 1756	1556	bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35.exe	27
PID 1556 wrote to memory of 1756	1556	bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35.exe	27

C:\Users\Admin\AppData\Local\Temp\bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35.exe
"C:\Users\Admin\AppData\Local\Temp\bf4a856a12e759b5bef59d65a3e34993721964d3b7ed718b7a61f329b4fbda35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 148
  2⤵
  - Program crash
  PID:1756

memory/1556-55-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download