e9e3fa507456735446cb4cbc31f4efed66c154fcd5598491b2f3dee47cd1c4c4

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 13:08

Target

71001f069b711a08e452878d423174af.exe
Size

317KB
MD5

71001f069b711a08e452878d423174af
SHA1

698cd4c636bb68ac67c471d4fdcc7c2eaba79218
SHA256

e9e3fa507456735446cb4cbc31f4efed66c154fcd5598491b2f3dee47cd1c4c4
SHA512

f778cb92d23020d466b5d7ff75072765faa0105d5a6e80152bf448c78afe9c12fcfc2d8c5825b5f4e389dc24923c1a869119c368c9c737da3321543e9125c797
SSDEEP

3072:Kg8j0Z4bGBrb+XTUfx2UM9kFSWo93w8+1+P4N4fMTdrCSV3eIGEnPTVrNrL/T6Nx:AVKBrbae2/eFSfJlQ++hcsrL/TKfCX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2536-0-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process
2456	2536	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2456	2536	71001f069b711a08e452878d423174af.exe	16
PID 2536 wrote to memory of 2456	2536	71001f069b711a08e452878d423174af.exe	16
PID 2536 wrote to memory of 2456	2536	71001f069b711a08e452878d423174af.exe	16
PID 2536 wrote to memory of 2456	2536	71001f069b711a08e452878d423174af.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 120
1⤵
- Program crash
PID:2456

C:\Users\Admin\AppData\Local\Temp\71001f069b711a08e452878d423174af.exe
"C:\Users\Admin\AppData\Local\Temp\71001f069b711a08e452878d423174af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536

memory/2536-0-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download