f0199dc0f12f6ccafbf32e14417bfec9c2e9bd207d678300bbc1aedd21813f4f

Analysis

max time kernel
135s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:32

Target

25e26b2aa08fdb696c36bd0a86c96b68.exe
Size

141KB
MD5

25e26b2aa08fdb696c36bd0a86c96b68
SHA1

24551b768e6888b1418ebcdb51448803da092427
SHA256

f0199dc0f12f6ccafbf32e14417bfec9c2e9bd207d678300bbc1aedd21813f4f
SHA512

6308a5c0f55b8da4eb4ccadb2466047df1c8690c3b14515386be36a288bb8a39ccf2c947e2501da425ce218538bd4c5dbfd14bd1ee853e3b16d4ea333576bf6a
SSDEEP

1536:TqBj4JLnyokEjWN0wo3xxXLrgtBWcqnV:uBj4IESN0wIrc5A

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2764-1-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2764-2-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/2764-3-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2764	2784	25e26b2aa08fdb696c36bd0a86c96b68.exe	92

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1920	2764	WerFault.exe	92
4060	2784	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	25e26b2aa08fdb696c36bd0a86c96b68.exe
2784	25e26b2aa08fdb696c36bd0a86c96b68.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2764	2784	25e26b2aa08fdb696c36bd0a86c96b68.exe	92
PID 2784 wrote to memory of 2764	2784	25e26b2aa08fdb696c36bd0a86c96b68.exe	92
PID 2784 wrote to memory of 2764	2784	25e26b2aa08fdb696c36bd0a86c96b68.exe	92
PID 2784 wrote to memory of 2764	2784	25e26b2aa08fdb696c36bd0a86c96b68.exe	92
PID 2784 wrote to memory of 2764	2784	25e26b2aa08fdb696c36bd0a86c96b68.exe	92

C:\Users\Admin\AppData\Local\Temp\25e26b2aa08fdb696c36bd0a86c96b68.exe
"C:\Users\Admin\AppData\Local\Temp\25e26b2aa08fdb696c36bd0a86c96b68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\25e26b2aa08fdb696c36bd0a86c96b68.exe
  2222
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 508
    3⤵
    - Program crash
    PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 1228
  2⤵
  - Program crash
  PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2764 -ip 2764
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2784 -ip 2784
1⤵
PID:4444

memory/2764-1-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2764-2-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2764-3-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2784-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2784-4-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download