3a0380e8e892f1b69161343f09e0ffbf198d2403fdc62bd84f18b8841f7380de

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 18:37

Target

00afbf06609753e9a59d30b7daff6e6a.exe
Size

1.2MB
MD5

00afbf06609753e9a59d30b7daff6e6a
SHA1

c6e05cc2430a762b097e3b8e9e81481af78b4c8a
SHA256

3a0380e8e892f1b69161343f09e0ffbf198d2403fdc62bd84f18b8841f7380de
SHA512

7f4f5ecd5d78bf71934ff0b346f0fa5c8c65caf13a72950d8ba042454cb30460166cf56ab21ce582252ac1e03c12d6a069415ed96b4d7f648c4ae49481c6bd24
SSDEEP

24576:Wmj6SpYCnR3dK57UGGMdNQMFoaSMwCVlbML9AbsJ0pKz/:8SpYCnRo7DrdpblwgbML7+4/

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2816-0-0x0000000000400000-0x00000000005E0000-memory.dmp	upx
behavioral2/memory/2816-2-0x0000000000400000-0x00000000005E0000-memory.dmp	upx
behavioral2/memory/2816-4-0x0000000000400000-0x00000000005E0000-memory.dmp	upx

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2276	2816	WerFault.exe	16
4428	2816	WerFault.exe	16
4984	2816	WerFault.exe	16
1968	2816	WerFault.exe	16
3988	2816	WerFault.exe	16
4508	2816	WerFault.exe	16
3768	2816	WerFault.exe	16

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Users\Admin\AppData\Local\Temp\00afbf06609753e9a59d30b7daff6e6a.exe
"C:\Users\Admin\AppData\Local\Temp\00afbf06609753e9a59d30b7daff6e6a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 856
  2⤵
  - Program crash
  PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 856
  2⤵
  - Program crash
  PID:4428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 856
  2⤵
  - Program crash
  PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 928
  2⤵
  - Program crash
  PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 856
  2⤵
  - Program crash
  PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 1200
  2⤵
  - Program crash
  PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 140
  2⤵
  - Program crash
  PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2816 -ip 2816
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2816 -ip 2816
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2816 -ip 2816
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2816 -ip 2816
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2816 -ip 2816
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2816 -ip 2816
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2816 -ip 2816
1⤵
PID:3104

memory/2816-0-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download
memory/2816-2-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download
memory/2816-3-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/2816-1-0x0000000002370000-0x00000000026F0000-memory.dmp

Filesize
3.5MB

Download
memory/2816-4-0x0000000000400000-0x00000000005E0000-memory.dmp

Filesize
1.9MB

Download