9943e6c58ff1ae2450ba3985a28259a63ceaa5aaf71c14f99ead00b628d64ef7

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 23:15

Target

9943e6c58ff1ae2450ba3985a28259a63ceaa5aaf71c14f99ead00b628d64ef7.exe
Size

99KB
MD5

dc75820b70fbdd199373601a15a307f9
SHA1

4938a6adfec3a4b591d0b159206352824b134737
SHA256

9943e6c58ff1ae2450ba3985a28259a63ceaa5aaf71c14f99ead00b628d64ef7
SHA512

53b93e2246a58b30053a058ce5efa757c2fd3bd0abe1e2efe208a2c756885ac603d036df053498b6cec033a4d76af20fc2f857a585aacaf38317e0b991921a4c
SSDEEP

3072:Ewi089AvUB1LZPE1AAQvCTjE/j15AY41C:I0wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4432-133-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/4432-134-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1420	4432	WerFault.exe	83

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4432	9943e6c58ff1ae2450ba3985a28259a63ceaa5aaf71c14f99ead00b628d64ef7.exe

C:\Users\Admin\AppData\Local\Temp\9943e6c58ff1ae2450ba3985a28259a63ceaa5aaf71c14f99ead00b628d64ef7.exe
"C:\Users\Admin\AppData\Local\Temp\9943e6c58ff1ae2450ba3985a28259a63ceaa5aaf71c14f99ead00b628d64ef7.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 712
  2⤵
  - Program crash
  PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4432 -ip 4432
1⤵
PID:684

memory/4432-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4432-134-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4432-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4432-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download