229c9168763d294d101b8840ec600966e2434d126e50cc976763a9b01d9755d0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:24

Target

005ff9fa6222df8ea25def471ca0b19c.exe
Size

5KB
MD5

005ff9fa6222df8ea25def471ca0b19c
SHA1

94819204df3d23e19c617b357d4337991ec8f030
SHA256

229c9168763d294d101b8840ec600966e2434d126e50cc976763a9b01d9755d0
SHA512

00627bc6120e2fbf80ac679d40dd0fc0f109de17339a6c4ab9c3143e7b240e99677bd3163bcaa310b0e6aaf8dfa9ece23eea1b8c24e4e07bcd154a5b9ff11a0e
SSDEEP

96:qCuhIwMyKXyMYV4S3OaCe8+BkkQga/30Wez1mQt7f7YINEQ+ps:Gh0yKCMYnncgaMHzg4D7YINEQt

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1212-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1212	WerFault.exe	13

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1936	1212	005ff9fa6222df8ea25def471ca0b19c.exe	28
PID 1212 wrote to memory of 1936	1212	005ff9fa6222df8ea25def471ca0b19c.exe	28
PID 1212 wrote to memory of 1936	1212	005ff9fa6222df8ea25def471ca0b19c.exe	28
PID 1212 wrote to memory of 1936	1212	005ff9fa6222df8ea25def471ca0b19c.exe	28

C:\Users\Admin\AppData\Local\Temp\005ff9fa6222df8ea25def471ca0b19c.exe
"C:\Users\Admin\AppData\Local\Temp\005ff9fa6222df8ea25def471ca0b19c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 136
  2⤵
  - Program crash
  PID:1936

memory/1212-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download