dcb9c489f4e0e73a0c0dc73b50371192ce981bdee15ddcf9b35b7821bddde0dc

Analysis

max time kernel
173s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:37

Target

4d2453505ef20093de88f7acee72ecc5.exe
Size

40KB
MD5

4d2453505ef20093de88f7acee72ecc5
SHA1

4148ded738c27e7e69411f30ecaed6c1500c44a6
SHA256

dcb9c489f4e0e73a0c0dc73b50371192ce981bdee15ddcf9b35b7821bddde0dc
SHA512

810f8225ac9767e2b02f7f49ed366629b39e6f96f448c7e0d042b47eab07bc3d2e16b91998ecd1540ffb159180636df18268e745fb3ec9abdb9406a49f0339a6
SSDEEP

768:bz0lTqHKfdzpPxmN6E/U8G0K1VNwuaExe1u+afd/ovLtR2HDqQZ5ogq:v0AHYpPYNa0K1XrHSLajd

Score

7^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2592-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1448-3-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2592-5-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1448-2-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1448-1-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2592 set thread context of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4688	1448	WerFault.exe	25

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25
PID 2592 wrote to memory of 1448	2592	4d2453505ef20093de88f7acee72ecc5.exe	25

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1448 -ip 1448
1⤵
PID:888

memory/1448-3-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1448-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1448-1-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2592-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2592-5-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download