ad3bcb65313043b1a43b8fb210f3a20a87df8a8145ed9a18b086d0859616caa2

Analysis

max time kernel
66s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
Size

125KB
MD5

f589a54f5660a756b745212fcc5b3c2c
SHA1

5103d785c2dba038f7ce2f7f00dbd55a3c1f9a3e
SHA256

1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31
SHA512

8effd05c1ead4342e6a612f5368469b7a923c9d7697cce074261bc9b078e75861a8105e2c179270cda00fe22a1d75e389d4a4c463ba8990c749d5ad7f029537b
SSDEEP

1536:vEpR+iRa2LNCkfAI6wzMb6tEVBLK5wvFS2qeAb1WVPShFBkblSAeTNa5G3U/1:DKxBMb6sBJfQASh3MlKTNa5P/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3968-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/3968-106-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe

description	ioc	process
File opened for modification	C:\Windows\PT2VkJ	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\geuSmtkH	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\Fpnyx	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\uj6pfkDci	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\8JhtTL6Eg	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\8fLmHR	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\JF8ryQ5w6d	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\Hgw1lW	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\6hyNtNbD	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\taEHYuQ	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\4gOoAXr	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\iLFwkEV	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\EK2v5	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\DFD3X	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\LyEse27	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\Kv6pJaV	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\qQM5eCXA	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\3p8jo3Twt	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\het7Wiy	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\jrrwSmA	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\F3cmc2h	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\gUb6u21b	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\IoQva	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\oD72fC7DA	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\dbCKWMaU	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\sMV2uO	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\BxHsyErk7x	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\fNPxs	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\PFrsxUdCUP	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\uCPVg3Rp	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\YwmGtCjkVn	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\GYVTOVg	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\GqjMsA	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\A6qTqvmP	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\klXRDcnQa	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\UXFUxC3DL	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\hayoWVHgfc	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\VeRVSKY4	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\uRH6lKpST	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\7gu4BO1	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\CmRa3xrPtM	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\7AgC6hT	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\HCncoBOS	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\eUkXhdFk	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\ajqMEU8w	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\I2FN2uE36	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\5h2CRxG6	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\63P2Gw2F5	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\vlOGRBJv4	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\QY1TU83vo7	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\V3iPKo	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\uCtuP	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\1JhCrxCt5d	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\jaCOKC8	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\XrNydOk	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\yUAOfy5Eag	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\NQRKdwqJcA	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\yNNXa	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\OYaSTet8	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\halk8gDAnN	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\M7Onl	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\EuM2cmv	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\ahVMS	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
File opened for modification	C:\Windows\bjrsIKt3F	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2928 3968 WerFault.exe 1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe

pid	pid_target	process	target process
2928	3968	WerFault.exe	1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe

C:\Users\Admin\AppData\Local\Temp\1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
"C:\Users\Admin\AppData\Local\Temp\1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe"
1⤵
- Drops file in Windows directory
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 248
2⤵
- Program crash
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3968 -ip 3968
1⤵
PID:4828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3968-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3968-105-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3968-106-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download