eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184

Analysis

max time kernel
169s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 06:02

Target

eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184.exe
Size

11KB
MD5

2369f9c7f412eecfb52da9efaa491776
SHA1

1d8e1306b8f77660db549a138c6eca91f3d90473
SHA256

eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184
SHA512

762218f6abf52ca6eb9747efae2ca4ccb0911cdcae32a2f1875da434722f5584bb31c4ea1a9f6cb83d9dff724f1da47b926c08b71a540e03bbfd51bb01165e14
SSDEEP

192:Aq91pWeh9eV6+FqXRsYQfSAwZpRI8rjp7Q5mIBK0+b7vK:AqLvveeRsYQfas4jpE34fS

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1272-132-0x0000000001000000-0x000000000100A000-memory.dmp	upx
behavioral2/memory/1272-133-0x0000000001000000-0x000000000100A000-memory.dmp	upx
behavioral2/memory/1272-135-0x0000000001000000-0x000000000100A000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2172	1272	WerFault.exe	82
228	1272	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2172	1272	eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184.exe	85
PID 1272 wrote to memory of 2172	1272	eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184.exe	85
PID 1272 wrote to memory of 2172	1272	eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184.exe	85

C:\Users\Admin\AppData\Local\Temp\eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184.exe
"C:\Users\Admin\AppData\Local\Temp\eeef900ee9c3319f759bd0426b1f88521302edc1ecadd6b716d8708780b46184.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 284
  2⤵
  - Program crash
  PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 284
  2⤵
  - Program crash
  PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1272 -ip 1272
1⤵
PID:4776

memory/1272-132-0x0000000001000000-0x000000000100A000-memory.dmp

Filesize
40KB

Download
memory/1272-133-0x0000000001000000-0x000000000100A000-memory.dmp

Filesize
40KB

Download
memory/1272-135-0x0000000001000000-0x000000000100A000-memory.dmp

Filesize
40KB

Download