69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c

Analysis

max time kernel
24s
max time network
42s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 06:23

Target

69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe
Size

532KB
MD5

84e6aa267c6970d2d777d60840390102
SHA1

c97e555e98c5bec69bcad9607cf0153ff827a141
SHA256

69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
SHA512

47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP

12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2020-54-0x000000013FA30000-0x000000013FB8F000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

904 2020 WerFault.exe 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe

pid	pid_target	process	target process
904	2020	WerFault.exe	69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe

description	pid	process	target process
PID 2020 wrote to memory of 904	2020	69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe	WerFault.exe
PID 2020 wrote to memory of 904	2020	69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe	WerFault.exe
PID 2020 wrote to memory of 904	2020	69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe
"C:\Users\Admin\AppData\Local\Temp\69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2020 -s 252
2⤵
- Program crash
PID:904

memory/904-55-0x0000000000000000-mapping.dmp

Download
memory/2020-54-0x000000013FA30000-0x000000013FB8F000-memory.dmp

Filesize
1.4MB

Download