14f66e5db64daa6dd4c0d21c37c2530063aac8eb557c162115096ed0b88a0745

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 18:57

Target

36235994d930eca10ed85c2a1da7d65b.exe
Size

232KB
MD5

36235994d930eca10ed85c2a1da7d65b
SHA1

30eb25ae5882dede38457d40a4c87d703f35d13d
SHA256

14f66e5db64daa6dd4c0d21c37c2530063aac8eb557c162115096ed0b88a0745
SHA512

b0a5593a102405af842a2b9e8ead00dfe35852319c539ccc30b83a58d56848cb5d2e73d5eca9dedf7f2bd83bd080ba31205085f0c1c04770ff6c28b543ad0b49
SSDEEP

3072:XQ9qevXCf/YumNZ2yctvBmrqz+kxY7DyDwH/Pmv53WUPEi1qdCSG7LIscHMrsQ0L:XnesdyctYrT7/PsW8EZd40seWs9Zxipk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1444-0-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/1444-1-0x0000000000400000-0x000000000044E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	1444	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2684	1444	36235994d930eca10ed85c2a1da7d65b.exe	28
PID 1444 wrote to memory of 2684	1444	36235994d930eca10ed85c2a1da7d65b.exe	28
PID 1444 wrote to memory of 2684	1444	36235994d930eca10ed85c2a1da7d65b.exe	28
PID 1444 wrote to memory of 2684	1444	36235994d930eca10ed85c2a1da7d65b.exe	28

C:\Users\Admin\AppData\Local\Temp\36235994d930eca10ed85c2a1da7d65b.exe
"C:\Users\Admin\AppData\Local\Temp\36235994d930eca10ed85c2a1da7d65b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 136
  2⤵
  - Program crash
  PID:2684

memory/1444-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1444-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download