fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:48

Target

fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981.exe
Size

164KB
MD5

de782c864a7bdf7f4c9f4c10cd279875
SHA1

3e706830f9e73ef993202d5d93624aa5651cbf5b
SHA256

fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981
SHA512

a6feb8dac42a1eb6b567e67f9abcdf67895f11cd3aa3d3d74b67d0ce9641fb95065004633bfbbe90aa33189c96b8e3980049939ba9ccaab8f807bf35d6a3444b
SSDEEP

1536:iaMmKEB9SeVOkNV9qpAUY539HpWwmgNkww5lx5lvLvEWgDAgvWSr:c29xzP53PWwnzelxEA8r

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1000-55-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1000	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 840	1000	fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981.exe	27
PID 1000 wrote to memory of 840	1000	fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981.exe	27
PID 1000 wrote to memory of 840	1000	fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981.exe	27
PID 1000 wrote to memory of 840	1000	fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981.exe	27

C:\Users\Admin\AppData\Local\Temp\fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981.exe
"C:\Users\Admin\AppData\Local\Temp\fc2bcc6888aa1cca9adf6c1a96c58d0dfee5ecdc51398e69018bd1262ba3e981.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 36
  2⤵
  - Program crash
  PID:840

memory/1000-55-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download