12be1ab570598ad725ac38ac0241f5857e2cca02090e113141355fd63120ddd7

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 22:12

Target

14daa5ec46531c7a361c1e28818f12e6.exe
Size

281KB
MD5

14daa5ec46531c7a361c1e28818f12e6
SHA1

e1043196b2db3d44f95ba9a9354f5af37caae709
SHA256

12be1ab570598ad725ac38ac0241f5857e2cca02090e113141355fd63120ddd7
SHA512

eb4f431d39ad317ef6996ae6f91846259e2dfb199302001a0279758acff9fa56924f68a2c2b2d17544cd6cfa2a92ba5c42227141d90976814faa98a02e99d602
SSDEEP

6144:rvN9OoP2wd0kOm1YzhtFAK3Obu4yU8mHKAnkZwgkbh50I+mziK:fOopPOTGKl4yU83Ankwb8Il

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1732-0-0x0000000001170000-0x00000000011BD000-memory.dmp	upx
behavioral1/memory/1732-1-0x0000000001170000-0x00000000011BD000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	1732	WerFault.exe	7

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3024	1732	14daa5ec46531c7a361c1e28818f12e6.exe	28
PID 1732 wrote to memory of 3024	1732	14daa5ec46531c7a361c1e28818f12e6.exe	28
PID 1732 wrote to memory of 3024	1732	14daa5ec46531c7a361c1e28818f12e6.exe	28
PID 1732 wrote to memory of 3024	1732	14daa5ec46531c7a361c1e28818f12e6.exe	28

C:\Users\Admin\AppData\Local\Temp\14daa5ec46531c7a361c1e28818f12e6.exe
"C:\Users\Admin\AppData\Local\Temp\14daa5ec46531c7a361c1e28818f12e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 128
  2⤵
  - Program crash
  PID:3024

memory/1732-0-0x0000000001170000-0x00000000011BD000-memory.dmp

Filesize
308KB

Download
memory/1732-1-0x0000000001170000-0x00000000011BD000-memory.dmp

Filesize
308KB

Download