da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2

Analysis

max time kernel
182s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 14:38

Target

da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
Size

141KB
MD5

384ad83d5c43971ec1ba74f48304207d
SHA1

e48bd6f9713a248fb5699a7f831918dd3c51a9c3
SHA256

da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2
SHA512

2162d0243ff92b85eb20f1af9aa9390fb00ec9908da5f08e5df4692a5b0899d249f257e7e67afbc1302d942e7e4c24e1b333f8e4dd221498921541e7e7c6d9af
SSDEEP

1536:Tz+yr3rzQnyP6y5o0clYvHFY0Iv8glIc9krYqqBsfiutdw+lIyVi0DM1PjXKCrqb:5Q/y5Cmf2zv+c6DqQzIPkw5t5O2FhlO

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3812-133-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3812-135-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3812-136-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

description	pid	process	target process
PID 4148 set thread context of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1972	3812	WerFault.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
3632	3812	WerFault.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

pid process

4148 da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

pid	process
4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

description	pid	process	target process
PID 4148 wrote to memory of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
PID 4148 wrote to memory of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
PID 4148 wrote to memory of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
PID 4148 wrote to memory of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
PID 4148 wrote to memory of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
PID 4148 wrote to memory of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
PID 4148 wrote to memory of 3812	4148	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe	da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe

C:\Users\Admin\AppData\Local\Temp\da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe
"C:\Users\Admin\AppData\Local\Temp\da670a8e51c560b28ad092ce7241c1bc5101d146cf62402515cc8b4fa82867e2.exe"
2⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 344
3⤵
- Program crash
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 368
3⤵
- Program crash
PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3812 -ip 3812
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3812 -ip 3812
1⤵
PID:3320

memory/3812-132-0x0000000000000000-mapping.dmp

Download
memory/3812-133-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3812-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3812-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download