7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 06:48

Target

7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe
Size

602KB
MD5

f49a471f795fe3a12b3c4614cd29f689
SHA1

ed1239ae95af75eaf8e4e6f0744b68a1d199962f
SHA256

7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244
SHA512

387b85cda79be530fd8723d9fd84bf5bb943166ab083047efe17425dd1c802e1ae02890f88b882ff8e859749ab6e6bac56cfce417aa178ee651d070f8a7c3d04
SSDEEP

12288:Ah4tgyE4tHdVB/+BHqA95nyH3CGQh13y7n7xh+4EObPsawmfWAFhN:w4trE4tHdmH9ZySV3wxUMLHFuA/

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3012-0-0x0000000000400000-0x0000000000511000-memory.dmp	upx
behavioral1/memory/3012-1-0x0000000000400000-0x0000000000511000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2016	3012	7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe	28
PID 3012 wrote to memory of 2016	3012	7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe	28
PID 3012 wrote to memory of 2016	3012	7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe	28
PID 3012 wrote to memory of 1720	3012	7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe	29
PID 3012 wrote to memory of 1720	3012	7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe	29
PID 3012 wrote to memory of 1720	3012	7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe	29

C:\Users\Admin\AppData\Local\Temp\7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe
"C:\Users\Admin\AppData\Local\Temp\7d52edd1f46bb0b3bb86a943bbd7274ba454408e460a132e4490bc27ecde6244.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\winlogon.exe
  winlogon
  2⤵
  PID:2016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3012 -s 184
  2⤵
  PID:1720

memory/3012-0-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download
memory/3012-1-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download