e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f

Analysis

max time kernel
33s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 06:23

Target

e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe
Size

537KB
MD5

17b4433e4688d03b6908bb235b17371f
SHA1

5571a95725c7b175013c269fcf167ff55008c8e3
SHA256

e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f
SHA512

6ec8f639fd78c41be9dcb1730ae74547147f4cf94bab30e5420ab0aa6796c57232e56d460589a13f591f5ed35591b615081bdfb7eddd267d509d5ce1d705d30e
SSDEEP

12288:h4lThwQGIQilGzWTifG1g6eUmRP0xAt3hIPGk8T:ilTOFq7TifGG6+J0xAt3qel

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/916-54-0x000000013F7F0000-0x000000013F953000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1404 916 WerFault.exe e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe

pid	pid_target	process	target process
1404	916	WerFault.exe	e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe

description	pid	process	target process
PID 916 wrote to memory of 1404	916	e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe	WerFault.exe
PID 916 wrote to memory of 1404	916	e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe	WerFault.exe
PID 916 wrote to memory of 1404	916	e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe
"C:\Users\Admin\AppData\Local\Temp\e5eb334cd06b77b445fd80a1d4e73f0137955ace8a2eebc3e59ed8b27a08cc1f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 916 -s 252
2⤵
- Program crash
PID:1404

memory/916-54-0x000000013F7F0000-0x000000013F953000-memory.dmp

Filesize
1.4MB

Download
memory/1404-55-0x0000000000000000-mapping.dmp

Download