f005a9fe8491b4e2e60ca4947391d6df9878fa734eb27a654665878af4e8bd37 | Triage

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:50

Sharing

Report Analysis Logs

General

Target

153cff0d85c3a9098b67253b4b09649d.exe
Size

24KB
MD5

153cff0d85c3a9098b67253b4b09649d
SHA1

2ac9964a169c1768732b500a7ffdf53727653c4f
SHA256

f005a9fe8491b4e2e60ca4947391d6df9878fa734eb27a654665878af4e8bd37
SHA512

887e9bbf273a4e0aeb6ba609940440914b90699d6195c3a0bf901ffcd1df01f98494b5ba18bdbf9d9791113d1aa98f7be93b11be21ed026bbc9b34dd8c8143b5
SSDEEP

768:VsaBC/iG0NC1rGUqWKRbtwRW3vATHxFha5wq3:eaBAihNC1rKWKRbYW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2012-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2012	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3068	2012	153cff0d85c3a9098b67253b4b09649d.exe	16
PID 2012 wrote to memory of 3068	2012	153cff0d85c3a9098b67253b4b09649d.exe	16
PID 2012 wrote to memory of 3068	2012	153cff0d85c3a9098b67253b4b09649d.exe	16
PID 2012 wrote to memory of 3068	2012	153cff0d85c3a9098b67253b4b09649d.exe	16

C:\Users\Admin\AppData\Local\Temp\153cff0d85c3a9098b67253b4b09649d.exe
"C:\Users\Admin\AppData\Local\Temp\153cff0d85c3a9098b67253b4b09649d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 88
  2⤵
  - Program crash
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download