adfac85b8fa80ab94d6e0f2749445405b7b9e0be81b720f1c94c19bd04292624

Analysis

max time kernel
132s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:31

Target

0e91d0a3c660060b5f81971c65355044.exe
Size

10KB
MD5

0e91d0a3c660060b5f81971c65355044
SHA1

4f46f42fa92e15f9212978b3e9d884b9e31ef75a
SHA256

adfac85b8fa80ab94d6e0f2749445405b7b9e0be81b720f1c94c19bd04292624
SHA512

d6bb12c19ea01426d37a2d8d1d779067d9e84f9f639dcc470577fa98deb21dbaef9d96fabf5010d8af8863ee397ac89274538bb5bedce2a57b1f50c8615b188d
SSDEEP

192:+uxI2aXosxyHolKNpt3IkHReTBjJWnG6:UFuptYkkR

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4796-1-0x0000000000400000-0x0000000000404000-memory.dmp	upx
behavioral2/memory/4796-2-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4796-4-0x0000000000400000-0x0000000000404000-memory.dmp	upx
behavioral2/memory/4796-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1928	4796	WerFault.exe	88
1672	4796	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1928	4796	0e91d0a3c660060b5f81971c65355044.exe	94
PID 4796 wrote to memory of 1928	4796	0e91d0a3c660060b5f81971c65355044.exe	94
PID 4796 wrote to memory of 1928	4796	0e91d0a3c660060b5f81971c65355044.exe	94

C:\Users\Admin\AppData\Local\Temp\0e91d0a3c660060b5f81971c65355044.exe
"C:\Users\Admin\AppData\Local\Temp\0e91d0a3c660060b5f81971c65355044.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 224
  2⤵
  - Program crash
  PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 224
  2⤵
  - Program crash
  PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4796 -ip 4796
1⤵
PID:4344

memory/4796-0-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4796-1-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4796-3-0x00000000001C0000-0x00000000001C3000-memory.dmp

Filesize
12KB

Download
memory/4796-2-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4796-4-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4796-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download