a67f82d744c59a2038071d1e97921093151fc191b0510e19ef0318b0fe048457

Analysis

max time kernel
181s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 07:30

Target

a67f82d744c59a2038071d1e97921093151fc191b0510e19ef0318b0fe048457.exe
Size

99KB
MD5

e08b0edeaae2bb87972e3b344eff276c
SHA1

44cd8d4af125efb69fb097740c574456ca6b5c35
SHA256

a67f82d744c59a2038071d1e97921093151fc191b0510e19ef0318b0fe048457
SHA512

7a332a0aacffb1176a104e8a94d112d04395ad44bd65259ecab258be134e016b18ad3453bca875169efa63375fb75b42e0ca753c550f505139070f84feaecdde
SSDEEP

3072:Mwi089AvUB1LZPE1AAQvCTjE/j15AY41C:g0wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4916-132-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/4916-133-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4168	4916	WerFault.exe	80

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4916	a67f82d744c59a2038071d1e97921093151fc191b0510e19ef0318b0fe048457.exe

C:\Users\Admin\AppData\Local\Temp\a67f82d744c59a2038071d1e97921093151fc191b0510e19ef0318b0fe048457.exe
"C:\Users\Admin\AppData\Local\Temp\a67f82d744c59a2038071d1e97921093151fc191b0510e19ef0318b0fe048457.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 768
  2⤵
  - Program crash
  PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4916 -ip 4916
1⤵
PID:4092

memory/4916-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4916-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4916-135-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4916-138-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download