b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f

Analysis

max time kernel
39s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 08:07

Target

b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f.exe
Size

12KB
MD5

fb574830324f0b84b4df74afcf5d032c
SHA1

201b7526b4386f7b5d105d6b452e0d8ae686e4d7
SHA256

b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f
SHA512

601bae6600b4fcc514428ca5323e2460ba3b141341d27d65741e6754459d2c216c5788fe5db0b86dfec679a6f903a66c2a28eeed66c135ff4a6461dae0cd8695
SSDEEP

192:vPXPzOdr49i293QxpgkU6Tc6Hzz1h7UqHyfMM+ilvMjNp05inRur:vPXKdrwL9miTEDzTLaD+dRq5iA

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1140-54-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	1140	WerFault.exe	6

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 996	1140	b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f.exe	27
PID 1140 wrote to memory of 996	1140	b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f.exe	27
PID 1140 wrote to memory of 996	1140	b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f.exe	27
PID 1140 wrote to memory of 996	1140	b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f.exe	27

C:\Users\Admin\AppData\Local\Temp\b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f.exe
"C:\Users\Admin\AppData\Local\Temp\b34d6330deb292bd83956f3b80ecdec3f43fa12f3cd85af0d4a9d48c94c7db3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 36
  2⤵
  - Program crash
  PID:996

memory/1140-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download