ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027

Analysis

max time kernel
186s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 12:17

Target

ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027.exe
Size

163KB
MD5

5227c00b89d793b48ca0c6fc6d9feebf
SHA1

82ea79d3e767bd502982ce38c974e2c8cb2fe842
SHA256

ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027
SHA512

453bf820f8ea1dfa560bacea4bb4892b9f3c4ca80616ff0a1ecd63f060f3a948b803fc73b89c7b8db39351590148e73cf2d570ad59587eb156699ae4560a2a40
SSDEEP

3072:fOC0WupegROgbKP8TrK6xk+GeqXiq6dN2d595sEF63M3j0CI5zxJW:frNgx3Tm6xBGVXPg2nPZp3j0d57

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4316-132-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/memory/4316-134-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3612	4316	WerFault.exe	42
2868	4316	WerFault.exe	42

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 3612	4316	ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027.exe	86
PID 4316 wrote to memory of 3612	4316	ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027.exe	86
PID 4316 wrote to memory of 3612	4316	ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027.exe	86

C:\Users\Admin\AppData\Local\Temp\ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027.exe
"C:\Users\Admin\AppData\Local\Temp\ee05591e923198a00641709d2e0604a778ba8cbd235c652bd3472af46acf3027.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 372
  2⤵
  - Program crash
  PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 372
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4316 -ip 4316
1⤵
PID:1088

memory/3612-135-0x0000000000000000-mapping.dmp

Download
memory/4316-132-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4316-133-0x00000000005E0000-0x00000000005F4000-memory.dmp

Filesize
80KB

Download
memory/4316-134-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download