7fdf162ee11e800260cccce05342f2a9f075c7ddd800d955c03ef6d914fa648a

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:33

Target

1604a7516dad202b4a5e4188662f0b89.exe
Size

40KB
MD5

1604a7516dad202b4a5e4188662f0b89
SHA1

360b1c0272ee64249b034df274e76786d93de69a
SHA256

7fdf162ee11e800260cccce05342f2a9f075c7ddd800d955c03ef6d914fa648a
SHA512

7d4c70ad9bd5bd702dcfb482263ff806ac6a2fe4870b36e153a3d9b5f050a28427c1438b4ebac4c7354ae621ca2e7ea38fd11e4ff354a9e027569fc99e5232ed
SSDEEP

768:iwpcf/KvSCgaZZLoKV/ZqtxrWWZkN4bGf4gK3p4Heb6W8jU5Cvx7VAUaIiQZzcJk:iwpcf/KvSVajV/ZqtxrWWZFvgK0XW2MC

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2928-0-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2928	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3004	2928	1604a7516dad202b4a5e4188662f0b89.exe	16
PID 2928 wrote to memory of 3004	2928	1604a7516dad202b4a5e4188662f0b89.exe	16
PID 2928 wrote to memory of 3004	2928	1604a7516dad202b4a5e4188662f0b89.exe	16
PID 2928 wrote to memory of 3004	2928	1604a7516dad202b4a5e4188662f0b89.exe	16

C:\Users\Admin\AppData\Local\Temp\1604a7516dad202b4a5e4188662f0b89.exe
"C:\Users\Admin\AppData\Local\Temp\1604a7516dad202b4a5e4188662f0b89.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 36
  2⤵
  - Program crash
  PID:3004

memory/2928-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download