08d51c0ace3d805ea621d71a35d130a9f5603945164960cd45dbc290cb8be2a0

Analysis

max time kernel
144s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:52

Target

68ce0e7962fc3b508130e4f267289c08.exe
Size

1.9MB
MD5

68ce0e7962fc3b508130e4f267289c08
SHA1

5173687070367296aa4a58700f6947227429afc7
SHA256

08d51c0ace3d805ea621d71a35d130a9f5603945164960cd45dbc290cb8be2a0
SHA512

145b047c2ce4623a221c5ec0d78c5d08408c5324e468141c07c1e6b84ab77f6d583db0cb7ce2c4d5385690d5709d3de21cab0881fdaed261da78187db5f5c248
SSDEEP

49152:HF4eSS8FPx2dplXQc0k7yo5758hBd8x0zy3F0DLyHNSuZX2SAQ9:HeeSHF52dplXQC7yoJaPd8x0zy3F0DuS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2616-0-0x0000000000400000-0x0000000000678000-memory.dmp	upx
behavioral1/memory/2616-1-0x0000000000400000-0x0000000000678000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	2616	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 1736	2616	68ce0e7962fc3b508130e4f267289c08.exe	28
PID 2616 wrote to memory of 1736	2616	68ce0e7962fc3b508130e4f267289c08.exe	28
PID 2616 wrote to memory of 1736	2616	68ce0e7962fc3b508130e4f267289c08.exe	28
PID 2616 wrote to memory of 1736	2616	68ce0e7962fc3b508130e4f267289c08.exe	28

C:\Users\Admin\AppData\Local\Temp\68ce0e7962fc3b508130e4f267289c08.exe
"C:\Users\Admin\AppData\Local\Temp\68ce0e7962fc3b508130e4f267289c08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 88
  2⤵
  - Program crash
  PID:1736

memory/2616-0-0x0000000000400000-0x0000000000678000-memory.dmp

Filesize
2.5MB

Download
memory/2616-1-0x0000000000400000-0x0000000000678000-memory.dmp

Filesize
2.5MB

Download