fb642527ccd36a01996cb8b5acbd44994b3207d8594078dc474506265b1d59b5

Analysis

max time kernel
112s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 04:56

Target

fb642527ccd36a01996cb8b5acbd44994b3207d8594078dc474506265b1d59b5.exe
Size

232KB
MD5

72fef97f8a931f42e858631adbb47d4e
SHA1

9bbc790469df346b2d01a37f9059aff90615d4b2
SHA256

fb642527ccd36a01996cb8b5acbd44994b3207d8594078dc474506265b1d59b5
SHA512

164801490864581087002f17631966cca05e07662370c302a7bcb6165991f5e393a70d21bb8da6242710732182e643b3b4be17e8728a151c6053d0b7b1ae9ddd
SSDEEP

6144:++qrBuYhK1r68Br3k4aGe6xk8YW4+osz6Do49DbG:++qrBuYhK1r68x04az6q88E8T9Da

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4832-135-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	4832	WerFault.exe	80

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4832	fb642527ccd36a01996cb8b5acbd44994b3207d8594078dc474506265b1d59b5.exe

C:\Users\Admin\AppData\Local\Temp\fb642527ccd36a01996cb8b5acbd44994b3207d8594078dc474506265b1d59b5.exe
"C:\Users\Admin\AppData\Local\Temp\fb642527ccd36a01996cb8b5acbd44994b3207d8594078dc474506265b1d59b5.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 848
  2⤵
  - Program crash
  PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4832 -ip 4832
1⤵
PID:1920

memory/4832-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4832-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4832-140-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download