53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:36

Target

53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe
Size

695KB
MD5

71b06297acab518ae39c8326bd806a2c
SHA1

b43171b8d64b4e88d0adfe78288f9447dd720b3e
SHA256

53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b
SHA512

573fb16eef6e2428c3000a9f17f06809f3dd18a8957b97ab771186e47193b3f2da626280e6f4dd4a1eb30996eda16b1ab39035cb428cf6da385ff66a3a3194e9
SSDEEP

12288:8SVDIl99kFgUymfhCx6Joe7OWCDx1arKXloe7S:8SVMl9+FgxmfM0TIb2C+uS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1752-3-0x0000000000250000-0x000000000025B000-memory.dmp	upx
behavioral1/memory/1752-4-0x0000000000250000-0x000000000025B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	1752	WerFault.exe	11

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe
1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe
1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2656	1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe	28
PID 1752 wrote to memory of 2656	1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe	28
PID 1752 wrote to memory of 2656	1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe	28
PID 1752 wrote to memory of 2656	1752	53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe	28

C:\Users\Admin\AppData\Local\Temp\53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe
"C:\Users\Admin\AppData\Local\Temp\53c4b32a8a781731afe7c143495df6cb33c924fef94d5fcc540b2cc9c1ca6f2b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 508
  2⤵
  - Program crash
  PID:2656

memory/1752-0-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/1752-2-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/1752-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1752-3-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/1752-4-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/1752-5-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/1752-6-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1752-7-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download