1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770

Analysis

max time kernel
312s
max time network
400s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 15:48

Target

1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe
Size

57KB
MD5

35e31932ceaac4665ae78504c51bc193
SHA1

58ff7642da3251bfaecdd21b590a3a727481a314
SHA256

1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770
SHA512

1cb3eda27a34a49f7af8f6fedd8aaf42a5483b61ded9901d87c2137b47db6aff2cc2493e4bc5b910612f9ce6b18ddd5e7a39d49fc6dc764421f726143dc412d3
SSDEEP

768:G+w2ABUMRfepD7H3az61T818/gy0ScBJX5vXQkdAlaf57vvJYlpUxbaSz:GuZj3aSV/rcPlBdAa7vqlpUxba

Score

8^/10

upx

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2476-134-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2476-137-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2476-138-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2476-139-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2476-140-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2476-141-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2476	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	2476	WerFault.exe	81

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81
PID 2144 wrote to memory of 2476	2144	1546b36e987b73fc65accc5b0c1c885224bd4a6d97f2d0a7ae41e079dfe9b770.exe	81

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2476 -ip 2476
1⤵
PID:4748

memory/2144-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2144-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2476-134-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2476-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2476-138-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2476-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2476-140-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2476-141-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download