e78b29c94d3a9c8cd9eac7a0214c36459567336287a6f6132fe6ab4b2bbd7d51

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:33

Target

1782c7ea5773887769b90cd9f62b0826.exe
Size

146KB
MD5

1782c7ea5773887769b90cd9f62b0826
SHA1

3ff9b7b2cf0d7715d8df7539c21fc581f0781f2d
SHA256

e78b29c94d3a9c8cd9eac7a0214c36459567336287a6f6132fe6ab4b2bbd7d51
SHA512

d702c1693abc40d00d20fdf7cb5f08ed688a418ea9d754aa52b39467b4e0ca8b0cb043ea711e124169b7ecd858bd1f5c85f1ac21c7a558611322d46d50d11559
SSDEEP

3072:MfDYVJWRyZoz6RW0yY1MhPBoG5p/Sh2pbOrwK7/fbx5jobh:2UPWRyZ05Yuln5yybOrb7x5jY

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2448-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2448-1-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	2448	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2840	2448	1782c7ea5773887769b90cd9f62b0826.exe	28
PID 2448 wrote to memory of 2840	2448	1782c7ea5773887769b90cd9f62b0826.exe	28
PID 2448 wrote to memory of 2840	2448	1782c7ea5773887769b90cd9f62b0826.exe	28
PID 2448 wrote to memory of 2840	2448	1782c7ea5773887769b90cd9f62b0826.exe	28

C:\Users\Admin\AppData\Local\Temp\1782c7ea5773887769b90cd9f62b0826.exe
"C:\Users\Admin\AppData\Local\Temp\1782c7ea5773887769b90cd9f62b0826.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 144
  2⤵
  - Program crash
  PID:2840

memory/2448-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2448-1-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download