1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90

Analysis

max time kernel
186s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:18

Target

1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe
Size

132KB
MD5

4fe9e7ea27c737f2194ab5428f66bdc9
SHA1

ec78aeb12b23c8e0740253277d4b39184834e258
SHA256

1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90
SHA512

3c0c7f14fd28e9949afa3aad762e59f32ed5969f64d182635ae506c1bf60cdbb954edb1ba123790edf6c582bf31fe0db503f32e892c22c2c559a0bdd9ee15607
SSDEEP

3072:jPB11ZWv2Z05i4305nI+W5/LA2N5lOMUOzPXWD/B:rBbMq05/SgJ8rMUl

Score

10^/10

upx

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4708 created 4808	4708	WerFaultSecure.exe	81

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3748-135-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3748-138-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3748-139-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3748-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3748	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3748	3368	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe	85
PID 3368 wrote to memory of 3748	3368	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe	85
PID 3368 wrote to memory of 3748	3368	1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe	85

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4808
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4808 -s 1008
  2⤵
  PID:2360

C:\Users\Admin\AppData\Local\Temp\1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe
"C:\Users\Admin\AppData\Local\Temp\1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\1635b8777081dbe973985f6879f541be7da05896628e769b64ac11485dd07e90.exe
  ?
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3748

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4808 -i 4808 -h 444 -j 448 -s 416 -d 2592
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4708

memory/3368-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3748-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3748-135-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3748-138-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3748-139-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3748-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3748-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download