b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 15:06

Target

b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45.exe
Size

62KB
MD5

6a007c1449507fac0ce6f46426d3f803
SHA1

c2a8d37324e6e401765f8980f5a2d71db7979dca
SHA256

b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45
SHA512

e9235ebfc24077a1d14850561d09f7cd4dca485dce095cf1dfc6d4f762873bfd29bad90539af63df45c804d759662910ddf59c59cbc9fa61c11bb4186422419e
SSDEEP

1536:W5hpX/rzVgICY665kHYGOFfTXCFuZHiRpsrqyM0et+RGk:eZiIl6gkGFfTyFukpqG5Y0k

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2184-132-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4636	2184	WerFault.exe	83
4220	2184	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 4636	2184	b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45.exe	85
PID 2184 wrote to memory of 4636	2184	b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45.exe	85
PID 2184 wrote to memory of 4636	2184	b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45.exe	85

C:\Users\Admin\AppData\Local\Temp\b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45.exe
"C:\Users\Admin\AppData\Local\Temp\b1dca5cd2781e8f8ff3d2a86fbe0baf4f53eeda50af1e2e2351448d803a03e45.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 316
  2⤵
  - Program crash
  PID:4636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 316
  2⤵
  - Program crash
  PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2184 -ip 2184
1⤵
PID:2964

memory/2184-132-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download