32b471e997102446999c9183106c9e21e471dff178542a282c518dd9aa3ef71d

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 19:51

Target

0eeac00781eb726f84033c96d39c99c6.exe
Size

99KB
MD5

0eeac00781eb726f84033c96d39c99c6
SHA1

7f33051d24a17ad09cb6233d9a7f85718bb0ddeb
SHA256

32b471e997102446999c9183106c9e21e471dff178542a282c518dd9aa3ef71d
SHA512

a8ae6ebd169da33412c860e3bba34fcd1989223b3d7bb1c363b65bf5e9ac2ac7085a1f102968fa949645d1b9a6c7048c88b3efe4a33bc4b328ec9d1dbdf56891
SSDEEP

3072:0wi089AvUB1LZPE1AAQvCTjE/j15AY41C:40wB1LlyVb+15AYF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4460-0-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3904	4460	WerFault.exe	15

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4460	0eeac00781eb726f84033c96d39c99c6.exe

C:\Users\Admin\AppData\Local\Temp\0eeac00781eb726f84033c96d39c99c6.exe
"C:\Users\Admin\AppData\Local\Temp\0eeac00781eb726f84033c96d39c99c6.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 720
  2⤵
  - Program crash
  PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4460 -ip 4460
1⤵
PID:3500

memory/4460-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4460-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4460-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4460-1-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/4460-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download