8752f48dd0c65b82790c38d7264658dfd75b7b141054788d09de7ad553e936d2

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:24

Target

02dab8763ef07099fae3e31f709528b2.exe
Size

576KB
MD5

02dab8763ef07099fae3e31f709528b2
SHA1

cb66b46504dc20d5f6ec7e1df3b51bc2e5d506d6
SHA256

8752f48dd0c65b82790c38d7264658dfd75b7b141054788d09de7ad553e936d2
SHA512

24ad3f4c37e9519aa1b82e13c38ec24021d69849a6207dd205b273236750ec389e96e247241a4ff11192d464d2796dfbf601990a66c12b9a14d0c2f7adea3064
SSDEEP

12288:Zo1r80oPFsgIQatgzgJbVqNJVfzfm4b+/4QbRKis4I4D:uSNjINPENJVfTR2/Mis4fD

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2156	02dab8763ef07099fae3e31f709528b2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/2156-5-0x0000000000400000-0x0000000000608000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	2156	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2228	2156	02dab8763ef07099fae3e31f709528b2.exe	15
PID 2156 wrote to memory of 2228	2156	02dab8763ef07099fae3e31f709528b2.exe	15
PID 2156 wrote to memory of 2228	2156	02dab8763ef07099fae3e31f709528b2.exe	15
PID 2156 wrote to memory of 2228	2156	02dab8763ef07099fae3e31f709528b2.exe	15

C:\Users\Admin\AppData\Local\Temp\02dab8763ef07099fae3e31f709528b2.exe
"C:\Users\Admin\AppData\Local\Temp\02dab8763ef07099fae3e31f709528b2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 220
  2⤵
  - Program crash
  PID:2228

memory/2156-0-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/2156-4-0x0000000000610000-0x0000000000683000-memory.dmp

Filesize
460KB

Download
memory/2156-5-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download