c6fba90850def8731ce1e4a47cdb8aa113a6dddc61eb775183a768a526e5db81 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:22

Sharing

Report Analysis Logs

General

Target

49015e5ae3f9a0a5526c13140b36a409.exe
Size

18KB
MD5

49015e5ae3f9a0a5526c13140b36a409
SHA1

ab6d432709a5cd93ab0ab2d2b2b4270777ed0579
SHA256

c6fba90850def8731ce1e4a47cdb8aa113a6dddc61eb775183a768a526e5db81
SHA512

76ff10f92ff35493b627b750f8ce186d1b100e94b71fe0950d223f8107b4e422923f4e79a3aaa7e8d798ae38052fbccc2df58a7611e70fe1fc732e801f2a9c8a
SSDEEP

384:2R8c63wGJ8siQDXUbcHhLL+kQmETWkR1wTqLbQZX0x:2RsR8jSSkQ2kT+qLbQy

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2508-0-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral1/memory/2508-2-0x0000000000400000-0x00000000004AB000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process
2224	2508	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2224	2508	49015e5ae3f9a0a5526c13140b36a409.exe	14
PID 2508 wrote to memory of 2224	2508	49015e5ae3f9a0a5526c13140b36a409.exe	14
PID 2508 wrote to memory of 2224	2508	49015e5ae3f9a0a5526c13140b36a409.exe	14
PID 2508 wrote to memory of 2224	2508	49015e5ae3f9a0a5526c13140b36a409.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 120
1⤵
- Program crash
PID:2224

C:\Users\Admin\AppData\Local\Temp\49015e5ae3f9a0a5526c13140b36a409.exe
"C:\Users\Admin\AppData\Local\Temp\49015e5ae3f9a0a5526c13140b36a409.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-1-0x0000000000320000-0x0000000000323000-memory.dmp

Filesize
12KB

Download
memory/2508-0-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/2508-2-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download