00f6a5bab490ee59ce69214d5d5e101063bea2cb9276245927d94e4cd0c1f22f

Analysis

max time kernel
149s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:01

Target

0dbdd196809b1ba3b39bf5c0d867d6e0.exe
Size

36KB
MD5

0dbdd196809b1ba3b39bf5c0d867d6e0
SHA1

a5c8baf2e6d3de465e09347859675695c5836b80
SHA256

00f6a5bab490ee59ce69214d5d5e101063bea2cb9276245927d94e4cd0c1f22f
SHA512

62752423261c27eaad911f2311051e078acf95480bbd57a9c47e84259089d67be03dc1bc0030a1a608d125fbe1af81f8457355a8cbbc4e87a58376d94eee90b9
SSDEEP

768:CvobeuWDkmKQkRZ/vpmcbZuwtEtNLnm14b1Gewc/fSTxBF3sSvk:Cvgefj4ZnBp96J//fcV3sSM

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1772-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1772-1-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	1772	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2296	1772	0dbdd196809b1ba3b39bf5c0d867d6e0.exe	28
PID 1772 wrote to memory of 2296	1772	0dbdd196809b1ba3b39bf5c0d867d6e0.exe	28
PID 1772 wrote to memory of 2296	1772	0dbdd196809b1ba3b39bf5c0d867d6e0.exe	28
PID 1772 wrote to memory of 2296	1772	0dbdd196809b1ba3b39bf5c0d867d6e0.exe	28

C:\Users\Admin\AppData\Local\Temp\0dbdd196809b1ba3b39bf5c0d867d6e0.exe
"C:\Users\Admin\AppData\Local\Temp\0dbdd196809b1ba3b39bf5c0d867d6e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 176
  2⤵
  - Program crash
  PID:2296

memory/1772-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1772-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download