7849640639a85734d40cc61e81f812f18e096e424c2fb03a86978632e9b98c9f | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:02

Sharing

Report Analysis Logs

General

Target

39f2be330210a1735f6f0a797f596bf5.exe
Size

73KB
MD5

39f2be330210a1735f6f0a797f596bf5
SHA1

e5a642f95554e3247dfed44ba59120510ac49f55
SHA256

7849640639a85734d40cc61e81f812f18e096e424c2fb03a86978632e9b98c9f
SHA512

8718dbd3f72ff3bf08f1592d1ff83b9eafb76f704da4c34ba509037a36e7e8f86edc1a12e82de4d2203872cca846098250c583707eb5398e6b64ebb54b3625b5
SSDEEP

1536:vpXfGxKjqArOYFm7BYUfng9fMGQkINB1Eqm:xXO2qoWZnkfIkIWqm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2040	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2860	2040	39f2be330210a1735f6f0a797f596bf5.exe	16
PID 2040 wrote to memory of 2860	2040	39f2be330210a1735f6f0a797f596bf5.exe	16
PID 2040 wrote to memory of 2860	2040	39f2be330210a1735f6f0a797f596bf5.exe	16
PID 2040 wrote to memory of 2860	2040	39f2be330210a1735f6f0a797f596bf5.exe	16

C:\Users\Admin\AppData\Local\Temp\39f2be330210a1735f6f0a797f596bf5.exe
"C:\Users\Admin\AppData\Local\Temp\39f2be330210a1735f6f0a797f596bf5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 140
  2⤵
  - Program crash
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2040-1-0x00000000003C0000-0x00000000003DB000-memory.dmp

Filesize
108KB

Download