58d924673d8d2e5d2a84f4258de6e056a27278af14047f2296b9b5397d6771ee | Triage

Analysis

max time kernel
141s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0af33826ca1dc1143ccb0c29426dcfc7.exe
Size

16KB
MD5

0af33826ca1dc1143ccb0c29426dcfc7
SHA1

ba027a25c1321a0d88dc18483cc6720e292a467b
SHA256

58d924673d8d2e5d2a84f4258de6e056a27278af14047f2296b9b5397d6771ee
SHA512

0afac3aabf97fc66e2c1fb13baf0825f7a5fb33b3bd9551a364284ce19fd89aed09f4d142878b43a6169162f5d1ae0e7a8a41f4e509faaf42a89f56e8699e216
SSDEEP

384:V9y+NoNOVvSbUb/M4E/Lkpwye8CpUrnW4easr0p:3cOMKM4KLk61xpUIap

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2348-0-0x0000000000400000-0x000000000040D695-memory.dmp	upx
behavioral1/memory/2348-1-0x0000000000400000-0x000000000040D695-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2348	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2668	2348	0af33826ca1dc1143ccb0c29426dcfc7.exe	28
PID 2348 wrote to memory of 2668	2348	0af33826ca1dc1143ccb0c29426dcfc7.exe	28
PID 2348 wrote to memory of 2668	2348	0af33826ca1dc1143ccb0c29426dcfc7.exe	28
PID 2348 wrote to memory of 2668	2348	0af33826ca1dc1143ccb0c29426dcfc7.exe	28

C:\Users\Admin\AppData\Local\Temp\0af33826ca1dc1143ccb0c29426dcfc7.exe
"C:\Users\Admin\AppData\Local\Temp\0af33826ca1dc1143ccb0c29426dcfc7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 92
  2⤵
  - Program crash
  PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-0-0x0000000000400000-0x000000000040D695-memory.dmp

Filesize
53KB

Download
memory/2348-1-0x0000000000400000-0x000000000040D695-memory.dmp

Filesize
53KB

Download