Analysis

  • max time kernel
    156s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2023, 07:35

General

  • Target

    f40dc24760d2c5a81213dbd676f33a0a980d2ad3f8c5dc13b6a44f508ac86916.exe

  • Size

    943KB

  • MD5

    e652f7edf97a54bc77200ade58e92ead

  • SHA1

    0ee8a869874d2f0b5fd44fa67666fe8f51c190ce

  • SHA256

    f40dc24760d2c5a81213dbd676f33a0a980d2ad3f8c5dc13b6a44f508ac86916

  • SHA512

    2c07dba4ec0e5abe7f70f2f45c3998da7482976147e4af6d020fcdab139fa26f163e193538103952d349be976b1f6312e08adaa63514555e06ce1f9abf40db3c

  • SSDEEP

    12288:PUOBhdJdSOgxbBAtb5hF/mNVqxZhJXizwj8v0h6aM3e7NhTkn:lBXJdSR+jhFEqFJXJjR6lOPon

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f40dc24760d2c5a81213dbd676f33a0a980d2ad3f8c5dc13b6a44f508ac86916.exe
    "C:\Users\Admin\AppData\Local\Temp\f40dc24760d2c5a81213dbd676f33a0a980d2ad3f8c5dc13b6a44f508ac86916.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 116
      2⤵
      • Program crash
      PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2092-0-0x00000000002A0000-0x000000000041D000-memory.dmp

    Filesize

    1.5MB

  • memory/2092-1-0x00000000002A0000-0x000000000041D000-memory.dmp

    Filesize

    1.5MB

  • memory/2092-2-0x00000000002A0000-0x000000000041D000-memory.dmp

    Filesize

    1.5MB