e72683e24ebdabb7a00069dfae0001966b86bd0240f76b40ac5b2c16470232ce | Triage

Analysis

max time kernel
142s
max time network
32s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

122e027039d1f8918dc843a06a77ec26.exe
Size

252KB
MD5

122e027039d1f8918dc843a06a77ec26
SHA1

ae5c4f8ac761830db489e1ea14c7706313075019
SHA256

e72683e24ebdabb7a00069dfae0001966b86bd0240f76b40ac5b2c16470232ce
SHA512

0326bd38487fd454686648779ef00b9a4e0405f5c5c154005636e1439eb46fff76b88fdf97bad94b6f31d83830a4bace224db2661532ff5f2713458d48b4beda
SSDEEP

6144:pxfNGEZC5qApM7szJVO7aIqWKvV+asBpG8eolEaqzTKIN:709usO7aH+pXyKS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000400000-0x00000000004AD000-memory.dmp	upx
behavioral1/memory/2212-1-0x0000000000400000-0x00000000004AD000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1480	2212	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1480	2212	122e027039d1f8918dc843a06a77ec26.exe	15
PID 2212 wrote to memory of 1480	2212	122e027039d1f8918dc843a06a77ec26.exe	15
PID 2212 wrote to memory of 1480	2212	122e027039d1f8918dc843a06a77ec26.exe	15
PID 2212 wrote to memory of 1480	2212	122e027039d1f8918dc843a06a77ec26.exe	15

C:\Users\Admin\AppData\Local\Temp\122e027039d1f8918dc843a06a77ec26.exe
"C:\Users\Admin\AppData\Local\Temp\122e027039d1f8918dc843a06a77ec26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 192
  2⤵
  - Program crash
  PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2212-1-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download