70ee299b4e6078d2aba114a5257158ee2b7b1884789c7c90a40755b573cb078b

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:05

Target

01c670cbd8f495853c2c1a4744bedfcf.exe
Size

134KB
MD5

01c670cbd8f495853c2c1a4744bedfcf
SHA1

629ac69f031670b183b291ff4bed7e10aea04e45
SHA256

70ee299b4e6078d2aba114a5257158ee2b7b1884789c7c90a40755b573cb078b
SHA512

6ca8307437a04307a761d0a9d0d96b991f9abd33ced5ad417f02ba81d774d9c65838208e0c36ed01d899b5e9e9e32a4a7500ecde9e7a8f98d37b60103f308915
SSDEEP

1536:qvXWW13O/RG2qy1C/pMhn7Stg/NDo9xntG6SwTAGjO7+sDAAH:quH/RGfpO7StR997TALihA

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3008-0-0x0000000000400000-0x0000000001118000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	3008	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2472	3008	01c670cbd8f495853c2c1a4744bedfcf.exe	27
PID 3008 wrote to memory of 2472	3008	01c670cbd8f495853c2c1a4744bedfcf.exe	27
PID 3008 wrote to memory of 2472	3008	01c670cbd8f495853c2c1a4744bedfcf.exe	27
PID 3008 wrote to memory of 2472	3008	01c670cbd8f495853c2c1a4744bedfcf.exe	27

C:\Users\Admin\AppData\Local\Temp\01c670cbd8f495853c2c1a4744bedfcf.exe
"C:\Users\Admin\AppData\Local\Temp\01c670cbd8f495853c2c1a4744bedfcf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 36
  2⤵
  - Program crash
  PID:2472

memory/3008-0-0x0000000000400000-0x0000000001118000-memory.dmp

Filesize
13.1MB

Download