31d5ec271c744397f48bfc6af418b450610ac39c718690f350b564d2e5a4994d

Analysis

max time kernel
175s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:12

Target

0699bcd46158669818cc9f8fef3fe753.exe
Size

134KB
MD5

0699bcd46158669818cc9f8fef3fe753
SHA1

faa3015fd6893289fda8fc59b5da433264a85844
SHA256

31d5ec271c744397f48bfc6af418b450610ac39c718690f350b564d2e5a4994d
SHA512

89268d68b9378f55d811394a30805c156b4e259c8d4794507fc9ac195b817bc0b4c5361bc0ae79daf292eed024aa8006ee919a78d3a13ef0e6e28b3ff27f69d5
SSDEEP

3072:s1u0Ge/rORlQLMvtWT4bLpVBBY1J4Bhk8OGVnIwQpzjout:sQBe/rOROM1WT4bL7Hz88OGVnI9HoS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2992-1-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	2992	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2688	2992	0699bcd46158669818cc9f8fef3fe753.exe	27
PID 2992 wrote to memory of 2688	2992	0699bcd46158669818cc9f8fef3fe753.exe	27
PID 2992 wrote to memory of 2688	2992	0699bcd46158669818cc9f8fef3fe753.exe	27
PID 2992 wrote to memory of 2688	2992	0699bcd46158669818cc9f8fef3fe753.exe	27

C:\Users\Admin\AppData\Local\Temp\0699bcd46158669818cc9f8fef3fe753.exe
"C:\Users\Admin\AppData\Local\Temp\0699bcd46158669818cc9f8fef3fe753.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 88
  2⤵
  - Program crash
  PID:2688

memory/2992-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2992-1-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download