adfac85b8fa80ab94d6e0f2749445405b7b9e0be81b720f1c94c19bd04292624 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:31

Sharing

Report Analysis Logs

General

Target

0e91d0a3c660060b5f81971c65355044.exe
Size

10KB
MD5

0e91d0a3c660060b5f81971c65355044
SHA1

4f46f42fa92e15f9212978b3e9d884b9e31ef75a
SHA256

adfac85b8fa80ab94d6e0f2749445405b7b9e0be81b720f1c94c19bd04292624
SHA512

d6bb12c19ea01426d37a2d8d1d779067d9e84f9f639dcc470577fa98deb21dbaef9d96fabf5010d8af8863ee397ac89274538bb5bedce2a57b1f50c8615b188d
SSDEEP

192:+uxI2aXosxyHolKNpt3IkHReTBjJWnG6:UFuptYkkR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x0000000000404000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	3044	WerFault.exe	1

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3044	0e91d0a3c660060b5f81971c65355044.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2924	3044	0e91d0a3c660060b5f81971c65355044.exe	16
PID 3044 wrote to memory of 2924	3044	0e91d0a3c660060b5f81971c65355044.exe	16
PID 3044 wrote to memory of 2924	3044	0e91d0a3c660060b5f81971c65355044.exe	16
PID 3044 wrote to memory of 2924	3044	0e91d0a3c660060b5f81971c65355044.exe	16

C:\Users\Admin\AppData\Local\Temp\0e91d0a3c660060b5f81971c65355044.exe
"C:\Users\Admin\AppData\Local\Temp\0e91d0a3c660060b5f81971c65355044.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 36
  2⤵
  - Program crash
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/3044-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download