23ca8a685ce0e8909b8f85efc310ca3f2a85272cb14d6d55faabfbb375757e13

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 10:35

Target

17948845708813e441d87f75b2580d3f.exe
Size

814KB
MD5

17948845708813e441d87f75b2580d3f
SHA1

3f2a4b3f5c5d116a2897468e1e6c18255ef5f940
SHA256

23ca8a685ce0e8909b8f85efc310ca3f2a85272cb14d6d55faabfbb375757e13
SHA512

33a4c3e42a55ebdabe59e0fda38ded3e4b0d73a1a3412e8367cd298baa21d270ddcbb4efdb618a89f7117e3d4e6294891759b80e17d2316ecc21f30f9bdedf6b
SSDEEP

12288:4HJ2L2gH1xX7TwfuqR1IXWPpmg45xM4MmFMQr3BMlaPKFgwuoGfEaC5OSmiRw:P9xrTwGqL5mDxT+c3BWg/BEaCzRw

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2148-0-0x0000000000060000-0x00000000002C6000-memory.dmp	upx
behavioral2/memory/2148-1-0x0000000000060000-0x00000000002C6000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4564	2148	WerFault.exe	16

Suspicious use of SetWindowsHookEx 9 IoCs

C:\Users\Admin\AppData\Local\Temp\17948845708813e441d87f75b2580d3f.exe
"C:\Users\Admin\AppData\Local\Temp\17948845708813e441d87f75b2580d3f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1472
  2⤵
  - Program crash
  PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2148 -ip 2148
1⤵
PID:3580

memory/2148-0-0x0000000000060000-0x00000000002C6000-memory.dmp

Filesize
2.4MB

Download
memory/2148-1-0x0000000000060000-0x00000000002C6000-memory.dmp

Filesize
2.4MB

Download