167674a0b80b7c0917fe98b2be188009086b6c46e79c80761e240a59c890c3d2

Analysis

max time kernel
34s
max time network
33s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:09

Target

0998fd095621417d1779737315a1ee16.exe
Size

22KB
MD5

0998fd095621417d1779737315a1ee16
SHA1

44c8904f4044beb2a7abddb3c8a1617f9848b36e
SHA256

167674a0b80b7c0917fe98b2be188009086b6c46e79c80761e240a59c890c3d2
SHA512

10982412c26d5bd4eb737ef9f6845d6c638a25335511887f9440443e4dd460e1328800fafd8b283db24702ba92a7ce82a4a903c2d949ed499560562ca2504698
SSDEEP

192:01xoH0N2mOtiw4G0ywTs8mr7c9LmsPaXfMJjc3KNfHwBOF67GLeZtOSv:0gH0+AGVwTsHr7vMthQ17GynOSv

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2880-0-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	2880	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1916	2880	0998fd095621417d1779737315a1ee16.exe	29
PID 2880 wrote to memory of 1916	2880	0998fd095621417d1779737315a1ee16.exe	29
PID 2880 wrote to memory of 1916	2880	0998fd095621417d1779737315a1ee16.exe	29
PID 2880 wrote to memory of 1916	2880	0998fd095621417d1779737315a1ee16.exe	29

C:\Users\Admin\AppData\Local\Temp\0998fd095621417d1779737315a1ee16.exe
"C:\Users\Admin\AppData\Local\Temp\0998fd095621417d1779737315a1ee16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 36
  2⤵
  - Program crash
  PID:1916

memory/2880-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download