e048b31a6f5f7de2d68a9bb2ee0e32b61638cf47c642879e563fd3ffbc921365

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:01

Target

13fd45d707bdab1dc04a06cedd986308.exe
Size

24KB
MD5

13fd45d707bdab1dc04a06cedd986308
SHA1

b965cbafdb1e435ca64dfccad38a7ee6f05bff92
SHA256

e048b31a6f5f7de2d68a9bb2ee0e32b61638cf47c642879e563fd3ffbc921365
SHA512

6cadfed7db5bfad8044725eca907184271bdc8dbc1be6def6c7227608c0232bf7425a8951a730b8cbb41616885703bd9d124ab6c2a9f2fdcb18331ec60cd74de
SSDEEP

384:vHFWizj12EH9irgf8A1JJ+n6QY/CHT89eIWgGNKL2JPAUTIeaK4aNJawcudoD7U9:PgQ5sr5AgjRgvW5NlJP1TznbcuyD7UM0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1896-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/memory/1896-13-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ddr011.ocx	13fd45d707bdab1dc04a06cedd986308.exe
File created	C:\Windows\SysWOW64\New.dll	13fd45d707bdab1dc04a06cedd986308.exe
File opened for modification	C:\Windows\SysWOW64\New.dll	13fd45d707bdab1dc04a06cedd986308.exe
File created	C:\Windows\SysWOW64\dsound.dll.259402814	13fd45d707bdab1dc04a06cedd986308.exe
File opened for modification	C:\Windows\SysWOW64\dsound.dll.259402814	13fd45d707bdab1dc04a06cedd986308.exe
File opened for modification	C:\Windows\SysWOW64\1011.ocx	13fd45d707bdab1dc04a06cedd986308.exe
File created	C:\Windows\SysWOW64\1011.ocx	13fd45d707bdab1dc04a06cedd986308.exe
File opened for modification	C:\Windows\SysWOW64\ddr011.ocx	13fd45d707bdab1dc04a06cedd986308.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1896	WerFault.exe	11

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1896	13fd45d707bdab1dc04a06cedd986308.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1948	1896	13fd45d707bdab1dc04a06cedd986308.exe	28
PID 1896 wrote to memory of 1948	1896	13fd45d707bdab1dc04a06cedd986308.exe	28
PID 1896 wrote to memory of 1948	1896	13fd45d707bdab1dc04a06cedd986308.exe	28
PID 1896 wrote to memory of 1948	1896	13fd45d707bdab1dc04a06cedd986308.exe	28

C:\Users\Admin\AppData\Local\Temp\13fd45d707bdab1dc04a06cedd986308.exe
"C:\Users\Admin\AppData\Local\Temp\13fd45d707bdab1dc04a06cedd986308.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 124
  2⤵
  - Program crash
  PID:1948

memory/1896-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1896-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download