c664dd583f55dcda18a801456fe61bc78f61cc61cc8753432d015da05c2e5d8d

Analysis

max time kernel
164s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 23:08

Target

1f7c0a020637fdc88c9cbeb0aff978d4.exe
Size

128KB
MD5

1f7c0a020637fdc88c9cbeb0aff978d4
SHA1

d05162f7d3025e410545981b661c21c94430d16f
SHA256

c664dd583f55dcda18a801456fe61bc78f61cc61cc8753432d015da05c2e5d8d
SHA512

2f6dac7cecfe6cd78e8da602d85756f698b2fe1e4f3c0f476fed94c84eab33082d995f97ae2fced60eef3316bcb209c58bc9e9b1c8501bf997f51918d7bd761c
SSDEEP

3072:vKaiOuf7rDiqNvt5H2/r7Ix2yEosOeOwprth23wy4PoDb:vNir7r9pH2/Ix2SsOwprtw3Sov

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3556-1-0x00000000006D0000-0x0000000000750000-memory.dmp	upx
behavioral2/memory/3556-3-0x00000000006D0000-0x0000000000750000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1360	3556	WerFault.exe	88
1988	3556	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1360	3556	1f7c0a020637fdc88c9cbeb0aff978d4.exe	94
PID 3556 wrote to memory of 1360	3556	1f7c0a020637fdc88c9cbeb0aff978d4.exe	94
PID 3556 wrote to memory of 1360	3556	1f7c0a020637fdc88c9cbeb0aff978d4.exe	94

C:\Users\Admin\AppData\Local\Temp\1f7c0a020637fdc88c9cbeb0aff978d4.exe
"C:\Users\Admin\AppData\Local\Temp\1f7c0a020637fdc88c9cbeb0aff978d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 312
  2⤵
  - Program crash
  PID:1360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 312
  2⤵
  - Program crash
  PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3556 -ip 3556
1⤵
PID:3300

memory/3556-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3556-1-0x00000000006D0000-0x0000000000750000-memory.dmp

Filesize
512KB

Download
memory/3556-2-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3556-3-0x00000000006D0000-0x0000000000750000-memory.dmp

Filesize
512KB

Download