85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2

Analysis

max time kernel
3s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe
Size

551KB
MD5

1d780d388626a0ceb81cbaeea62735f4
SHA1

bca9bc959337582137ff4ca22d598e5206dca10a
SHA256

85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2
SHA512

c4d48e66edd218bc6326a4251858236ca3371749bc691d667049e672008ba4c4bd8439c96d018d4b88328dbfd87a7722530cf99744a3f0617b9b19d78c3094c6
SSDEEP

6144:7NSMzXmbO1OO80Vxn1p4Cs0sxefKVR2HAmQolIqXpIe+3okSh8W9OonGX03fATiK:sQXJjvdpHzsxefi2gIb+3LonGkv4nKi7

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1188-66-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1188 set thread context of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	444	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 1188 wrote to memory of 444	1188	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	28
PID 444 wrote to memory of 1368	444	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	29
PID 444 wrote to memory of 1368	444	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	29
PID 444 wrote to memory of 1368	444	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	29
PID 444 wrote to memory of 1368	444	85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe	29

C:\Users\Admin\AppData\Local\Temp\85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe
"C:\Users\Admin\AppData\Local\Temp\85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe
  "C:\Users\Admin\AppData\Local\Temp\85aadf758fc7c85bd8e2a00307d1c416dc6fb42af2f92743d69f1b28b64be0f2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 96
    3⤵
    - Program crash
    PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-70-0x0000000000410000-0x0000000000412000-memory.dmp

Filesize
8KB

Download
memory/444-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-73-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-56-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/444-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1188-66-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download