664fd170b1d07e372b3daa91aab78a8151d3f0b0361a2b3157b405314dd219a2 | Triage

Resubmissions

20/04/2023, 08:22

230420-j9jsfaae7s 10

27/03/2023, 09:38

230327-lmbvescg32 10

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2023, 08:22

Sharing

Report Analysis Logs

General

Target

36000.exe
Size

416KB
MD5

51f00e56b4ef21e6b7d6685ca3fbad1a
SHA1

c145e5e23cd95de4c0b521f0eb7ded59ba0a381e
SHA256

4209035f042bcd79fe91997c8466cfdd890e740d8cb85b3076d7a5e79891f441
SHA512

69be029f0183cf3b425703467beee190bba49a3fe78cebd06e6c54c5ff550a6b9e18c704677a4587bef9ef83ffa5a38d6879717991fc3362d3686ab9f5cfb876
SSDEEP

6144:cXVDAhO3GzujrS6DfgSf2WPpx7MZyCwc9DMypdi8UAfndbeA0u9Adqhhs56EDL0C:YauGgSqntxwpTMf8TdIqAD4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/memory/2572-133-0x0000000000FF0000-0x000000000110F000-memory.dmp	upx
behavioral5/memory/2572-134-0x0000000000FF0000-0x000000000110F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	2572	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\36000.exe
"C:\Users\Admin\AppData\Local\Temp\36000.exe"
1⤵
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 244
  2⤵
  - Program crash
  PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2572 -ip 2572
1⤵
PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-133-0x0000000000FF0000-0x000000000110F000-memory.dmp

Filesize
1.1MB

Download
memory/2572-134-0x0000000000FF0000-0x000000000110F000-memory.dmp

Filesize
1.1MB

Download