f00b111259a8ccff69f9014d01bd102b25dcf3558431f071c000ab5c295a675c | Triage

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 10:18

Sharing

Report Analysis Logs

General

Target

16a20a4f49eff29013a605d54db11e21.exe
Size

100KB
MD5

16a20a4f49eff29013a605d54db11e21
SHA1

07cfb50ba37d5cbe2e952ce138e25f5627d383d1
SHA256

f00b111259a8ccff69f9014d01bd102b25dcf3558431f071c000ab5c295a675c
SHA512

a33b7454524a45b84ee81342b21ff5ea96b08825864ca5a908e2410a7e712f2828581a83b81dbed45d4f23c3933d4e20783be8e5ae4aa707deae4994b9f67229
SSDEEP

1536:/sAAA3PU7pDiRhVex0SUrWTqA6ibqsCfBqk:/sAAAfGDkSdmAjbrCfBp

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2664-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/2664-1-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3980	2664	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\16a20a4f49eff29013a605d54db11e21.exe
"C:\Users\Admin\AppData\Local\Temp\16a20a4f49eff29013a605d54db11e21.exe"
1⤵
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 364
  2⤵
  - Program crash
  PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2664 -ip 2664
1⤵
PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2664-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download