6b6384a01d6f7d0657a94fd448cb1c60810237538b613dcade5f95e1c35cd904

Analysis

max time kernel
161s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 13:12

Target

713ffcc2fe9efb9fc79a26e0a05a2846.exe
Size

99KB
MD5

713ffcc2fe9efb9fc79a26e0a05a2846
SHA1

6c7c4b6158f96a80b41205e226088a3b4f4c582e
SHA256

6b6384a01d6f7d0657a94fd448cb1c60810237538b613dcade5f95e1c35cd904
SHA512

d19c39cc8003656712e68e31cefc43dc431145f52b9814363ed4c6d6d39962ca192862b7b3d9879198a061064e3aac01491686ce96bb4d3255cb3684cc5141bd
SSDEEP

3072:Awi089AvUB1LZPE1AAQvCTjE/j15AY41C:M0wB1LlyVb+15AYF

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4540-0-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	4540	WerFault.exe	87

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4540	713ffcc2fe9efb9fc79a26e0a05a2846.exe

C:\Users\Admin\AppData\Local\Temp\713ffcc2fe9efb9fc79a26e0a05a2846.exe
"C:\Users\Admin\AppData\Local\Temp\713ffcc2fe9efb9fc79a26e0a05a2846.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 612
  2⤵
  - Program crash
  PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4540 -ip 4540
1⤵
PID:2592

memory/4540-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4540-1-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/4540-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4540-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4540-9-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download