3c9049cca53f84f34dda037bd93a5ee98efcf65c5a5b5f014a030989f1575f7d | Triage

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

02161bec5c42f283945e217c7bcaadf1.exe
Size

8KB
MD5

02161bec5c42f283945e217c7bcaadf1
SHA1

7d27dabe253de48832abe1b3413896525a0d3886
SHA256

3c9049cca53f84f34dda037bd93a5ee98efcf65c5a5b5f014a030989f1575f7d
SHA512

2ab6e7cefb743be0f4d618379f75cc1c4d4a4b0f1551599c4a2c0bcc940b313162e86fe12cc907b4a0f650000aeaf94783aee5aeaedce2a7bd2d853e6abff6b9
SSDEEP

192:59f2Qq1NCzWisQksvEPMR3h1CZ5/OyRsJ0t/:r1WIrEcgpvVB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1732-0-0x0000000013140000-0x0000000013147000-memory.dmp	upx
behavioral1/memory/1732-1-0x0000000013140000-0x0000000013147000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1112	1732	02161bec5c42f283945e217c7bcaadf1.exe	28
PID 1732 wrote to memory of 1112	1732	02161bec5c42f283945e217c7bcaadf1.exe	28
PID 1732 wrote to memory of 1112	1732	02161bec5c42f283945e217c7bcaadf1.exe	28
PID 1732 wrote to memory of 1112	1732	02161bec5c42f283945e217c7bcaadf1.exe	28

C:\Users\Admin\AppData\Local\Temp\02161bec5c42f283945e217c7bcaadf1.exe
"C:\Users\Admin\AppData\Local\Temp\02161bec5c42f283945e217c7bcaadf1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 140
  2⤵
  - Program crash
  PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000013140000-0x0000000013147000-memory.dmp

Filesize
28KB

Download
memory/1732-1-0x0000000013140000-0x0000000013147000-memory.dmp

Filesize
28KB

Download