3a8608d16004e8b8b7f90692cc291c3ee0ffd7bee5b2e72ba67c9a5f6cee8d36 | Triage

Analysis

max time kernel
143s
max time network
37s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:05

Sharing

Report Analysis Logs

General

Target

file.exe
Size

14KB
MD5

1703a99e8291f3c0fa0731e7978e9492
SHA1

af55895c57421de7b1c990790d7356d39b3531b0
SHA256

48099fe656d16023a8f895e2e1176670749e0c99b8096ad806b3057f3cada440
SHA512

b75fde745ca35f8380f8250cac0f4a8ab508179a0424b147c6a1146172ad46a8ada1c30e2def5947ca2ffec0695895fe810e6f62c91fd9b06d3b5b582ae9dbab
SSDEEP

384:DUdkH9FOjujpBueWUKy/620+cb0zhXDDBinl7uJg+A:DUKdFOjQpBPWbfgk+XD9K7

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/1704-0-0x0000000000400000-0x000000000090D000-memory.dmp	upx
behavioral3/memory/1704-1-0x0000000000400000-0x000000000090D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	1704	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2964	1704	file.exe	28
PID 1704 wrote to memory of 2964	1704	file.exe	28
PID 1704 wrote to memory of 2964	1704	file.exe	28
PID 1704 wrote to memory of 2964	1704	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 92
  2⤵
  - Program crash
  PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download
memory/1704-1-0x0000000000400000-0x000000000090D000-memory.dmp

Filesize
5.1MB

Download