1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14/11/2023, 17:31

231114-v3qg7acf42 10

14/11/2023, 17:21

28/10/2023, 19:29

24/10/2023, 13:29

18/10/2023, 12:04

07/09/2023, 12:10

Analysis

max time kernel
20s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/09/2023, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe
Size

6KB
MD5

9c35b0f91e55bd95ae535256b9b44a9b
SHA1

3d1811c67e784dd706d9588b6da77925592592c9
SHA256

82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67
SHA512

a2e89f38fbf00e3126ceb71adf8da3a822702f9d8639bc0e7f57db8b51eac86efc0af34820a1244dd394640323c8e61d065b5d871ccc49ce4b1080929ce53219
SSDEEP

192:oba5FJIXA/becdOzfawCzWQMpMKhAKgbmFTNw:hGA/bvdg4zzM6wgqFe

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral17/memory/1864-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral17/memory/1864-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	1864	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2936	1864	82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe	28
PID 1864 wrote to memory of 2936	1864	82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe	28
PID 1864 wrote to memory of 2936	1864	82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe	28
PID 1864 wrote to memory of 2936	1864	82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe	28

C:\Users\Admin\AppData\Local\Temp\82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe
"C:\Users\Admin\AppData\Local\Temp\82d1e979d2e673d0b1a47d34c1c968582185e284e0532ed66fd69d0e21063c67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 36
  2⤵
  - Program crash
  PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1864-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download