f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 21:55

Target

f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
Size

28KB
MD5

0dff44bae805bb420d88ff51c2be3591
SHA1

f15870b10ad3ab41e2da6fc2d8f9287c879b963f
SHA256

f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87
SHA512

b6a3479fd773583e45aafbf9974ca8aa972eb69c8377162cb5cb641e0b786de2b8fa4cdecb56e50cae5bce4108945ebc15d8b481057b5f82468c887ef42e027a
SSDEEP

768:QFDdi4MM/y8zSf+h3kJ9IcaH6R8yDam+UP0L:pH+f6W6NMUP0L

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1900-55-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tmd133	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\TYmsimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\aaa_148	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\tmd133	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\TYmsimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\aaa_148	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\msimg32.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
File created	C:\Windows\SysWOW64\TYd3d8.dll	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
240	1900	WerFault.exe	18

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1900	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 240	1900	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe	28
PID 1900 wrote to memory of 240	1900	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe	28
PID 1900 wrote to memory of 240	1900	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe	28
PID 1900 wrote to memory of 240	1900	f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe	28

C:\Users\Admin\AppData\Local\Temp\f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe
"C:\Users\Admin\AppData\Local\Temp\f38c32a36c6291daff89a5f24c2d77255f906172e630008e5b5c2c3ecb13ee87.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 176
  2⤵
  - Program crash
  PID:240

memory/1900-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download