9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2

Analysis

max time kernel
268s
max time network
360s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:49

Target

9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2.exe
Size

140KB
MD5

ed3a8cf37b47a68cc5679ce1cc727e28
SHA1

17cf3cf1ded7dc80c7c1394bdab3dd296697b614
SHA256

9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2
SHA512

ddee8f6e1d1e9a843145fadfcc8a1881fe445c4c57207ba23a16b2c2a25701bc387b3e1f02aaf11806de02617063ae33c8ffe1c0eb88b2a12d941931382d19f2
SSDEEP

3072:AMA0FDpxawwHGJDJfWUomtKMazMdR23SDvugEQMQ9Nxhjg:Ad0QwnJDJfIWdRRDEu/8

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3776-132-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3812	3776	WerFault.exe	79
4344	3776	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 3812	3776	9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2.exe	82
PID 3776 wrote to memory of 3812	3776	9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2.exe	82
PID 3776 wrote to memory of 3812	3776	9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2.exe	82

C:\Users\Admin\AppData\Local\Temp\9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2.exe
"C:\Users\Admin\AppData\Local\Temp\9209e22e4195e7050d947c80939558fdf16b83d98bc60df07ddfd5f5c10a8de2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 408
  2⤵
  - Program crash
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 408
  2⤵
  - Program crash
  PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3776 -ip 3776
1⤵
PID:4124

memory/3776-132-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download