96057fe835bba32454d81a1a6dfa9643d40be8f59604b65cdd80184d03869dac

Analysis

max time kernel
146s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 21:49

Target

04d8839bd94072bb9f975de7b81046c0.exe
Size

125KB
MD5

04d8839bd94072bb9f975de7b81046c0
SHA1

c9b58e41c44849a652399e53d83744325685a263
SHA256

96057fe835bba32454d81a1a6dfa9643d40be8f59604b65cdd80184d03869dac
SHA512

267d6e35aae16a672fd24b64d96caf54a2b6b00846518439b261aa6a585225f571d7dbaf3510ed43eaaa0a5d067c04c71e0a944b767424804a4100b593140b7c
SSDEEP

3072:uv6nW5VmhmlRkGGvy+xmFa7U9DZnjzGEq75E68VonareMw3RkU:hnNmlRkGayPa7Udo95E68aarcRkU

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3320-1-0x0000000000530000-0x00000000005B0000-memory.dmp	upx
behavioral2/memory/3320-3-0x0000000000530000-0x00000000005B0000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2004	3320	WerFault.exe	87
4100	3320	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 2004	3320	04d8839bd94072bb9f975de7b81046c0.exe	95
PID 3320 wrote to memory of 2004	3320	04d8839bd94072bb9f975de7b81046c0.exe	95
PID 3320 wrote to memory of 2004	3320	04d8839bd94072bb9f975de7b81046c0.exe	95

C:\Users\Admin\AppData\Local\Temp\04d8839bd94072bb9f975de7b81046c0.exe
"C:\Users\Admin\AppData\Local\Temp\04d8839bd94072bb9f975de7b81046c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 312
  2⤵
  - Program crash
  PID:2004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 312
  2⤵
  - Program crash
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3320 -ip 3320
1⤵
PID:1000

memory/3320-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3320-1-0x0000000000530000-0x00000000005B0000-memory.dmp

Filesize
512KB

Download
memory/3320-2-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3320-3-0x0000000000530000-0x00000000005B0000-memory.dmp

Filesize
512KB

Download