799fb05b7cc708dffea15f4d15dfb205c26a4795051d61f692da06890e8758b8

Analysis

max time kernel
90s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 07:35

Target

799fb05b7cc708dffea15f4d15dfb205c26a4795051d61f692da06890e8758b8.exe
Size

99KB
MD5

9ba7538b5a6c20095e8ae2a721b985f9
SHA1

3e0fc3d11e4ff00a793cc27565bb1f7fba54b5f2
SHA256

799fb05b7cc708dffea15f4d15dfb205c26a4795051d61f692da06890e8758b8
SHA512

b9ad79ecd25be7f15c773dd30ef8790388c3659aac3a5346127d22d15fb2cf9b599134597d9bd3505ac3c5e066f1c831118635138ca4ff12d31e2bcad874423a
SSDEEP

3072:wwi089AvUB1LZPE1AAQvCTjE/j15AY41C:80wB1LlyVb+15AYF

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/848-132-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	848	WerFault.exe	81

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
848	799fb05b7cc708dffea15f4d15dfb205c26a4795051d61f692da06890e8758b8.exe

C:\Users\Admin\AppData\Local\Temp\799fb05b7cc708dffea15f4d15dfb205c26a4795051d61f692da06890e8758b8.exe
"C:\Users\Admin\AppData\Local\Temp\799fb05b7cc708dffea15f4d15dfb205c26a4795051d61f692da06890e8758b8.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 504
  2⤵
  - Program crash
  PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 848 -ip 848
1⤵
PID:524

memory/848-132-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/848-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/848-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download