ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7

Analysis

max time kernel
54s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:25

Target

ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7.exe
Size

200KB
MD5

f6850ed4c5f190596b7a34dc556a5af4
SHA1

5542ab5136cc78962b2977c31f5d811ab6774e93
SHA256

ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7
SHA512

04298a3e30b3e93c99d6e480caf8d4f63c21aced18d136fe5e091f28a560a39093e6189d0f7972208f2a8670ee5618df2acaedd6355d4f3d2a0a041bdafe7b6d
SSDEEP

3072:OYGoQzoTYd3bmcMDJ0XERNVYd3bmcMDJ0XERNJm3Dr1gxdojc:azoyblMtDbyblMtDjK1MGjc

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1364-55-0x0000000000400000-0x000000000047996A-memory.dmp	upx
behavioral1/memory/1364-57-0x0000000000400000-0x000000000047996A-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	1364	WerFault.exe	22

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 832	1364	ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7.exe	28
PID 1364 wrote to memory of 832	1364	ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7.exe	28
PID 1364 wrote to memory of 832	1364	ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7.exe	28
PID 1364 wrote to memory of 832	1364	ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7.exe	28

C:\Users\Admin\AppData\Local\Temp\ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7.exe
"C:\Users\Admin\AppData\Local\Temp\ae0828f59dfd84c4450a7842928906502f7614db85e286d84aad724455a517b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 148
  2⤵
  - Program crash
  PID:832

memory/1364-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-55-0x0000000000400000-0x000000000047996A-memory.dmp

Filesize
486KB

Download
memory/1364-57-0x0000000000400000-0x000000000047996A-memory.dmp

Filesize
486KB

Download