f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc

General

Target

f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe
Size

1.3MB
MD5

68045f538d39068351fb4de464031d35
SHA1

e3bf32c59e469d60405a041272847ce49a99e5ff
SHA256

f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc
SHA512

3d7f4626941df9fd4538424640b19a34648e48d71b65a30166a3bcedd0e51ea35c5c7152525beed03043120cba6040b9424b1882d37837110e3ddf0cb4e7c9e7
SSDEEP

12288:1HiRsFvz1J+YA457NotY1kWwy8v510QK9hkmCM5Dbw3MKskhWkd/SMZoSvbUHEu1:1H9NpJZAu7E/1Shkmt5D61hWkIMrbJe

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1064-132-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-135-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-134-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-136-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-137-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-139-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-141-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-143-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-145-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-147-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-149-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-151-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-153-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-155-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-157-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-159-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-161-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-163-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-165-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-167-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-169-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-171-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-173-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-175-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-177-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/1064-178-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1520	1064	WerFault.exe	78
3648	1064	WerFault.exe	78

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1064	f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe
1064	f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe
1064	f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe
1064	f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe
1064	f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe

C:\Users\Admin\AppData\Local\Temp\f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe
"C:\Users\Admin\AppData\Local\Temp\f4998aae426aa79857a3fc359bc7352eae28e88321b76993f8359c1d834b57dc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 1636
  2⤵
  - Program crash
  PID:1520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 1636
  2⤵
  - Program crash
  PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1064 -ip 1064
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1064 -ip 1064
1⤵
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-132-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-135-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-134-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-136-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-137-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-139-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-141-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-143-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-145-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-147-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-149-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-151-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-153-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-155-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-157-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-159-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-161-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-163-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-165-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-167-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-169-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-171-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-173-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-175-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-177-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/1064-178-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads