172704c7931dd235452e3109f554c7e641fae411bce5128a3f7c337fe92e3e85

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:31

Target

15fc6104fce791f8f354775d94f78d91.exe
Size

382KB
MD5

15fc6104fce791f8f354775d94f78d91
SHA1

9cd7d5e29e2b98b0a4a8ec7dcb140620878da90e
SHA256

172704c7931dd235452e3109f554c7e641fae411bce5128a3f7c337fe92e3e85
SHA512

48113bee497e73d4d434caecb6d5de6c38b67db05788e2a1365c1b6e853d5a8ba48d2762e2f22d827c71429735a2338f0f4ffc5ee65c4449aed3a5989d83f1d8
SSDEEP

6144:yluRB1GqKNdprzxv4aKFn/09SmaCp18BxJF5iNVMk9fEiKZFwt8Pkot4vq+qk5C:yIRBVKT4aKN/ed8bjEMk9UFwOsot4C6

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2760-2-0x0000000000260000-0x000000000033E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2760	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2664	2760	15fc6104fce791f8f354775d94f78d91.exe	28
PID 2760 wrote to memory of 2664	2760	15fc6104fce791f8f354775d94f78d91.exe	28
PID 2760 wrote to memory of 2664	2760	15fc6104fce791f8f354775d94f78d91.exe	28
PID 2760 wrote to memory of 2664	2760	15fc6104fce791f8f354775d94f78d91.exe	28

C:\Users\Admin\AppData\Local\Temp\15fc6104fce791f8f354775d94f78d91.exe
"C:\Users\Admin\AppData\Local\Temp\15fc6104fce791f8f354775d94f78d91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 196
  2⤵
  - Program crash
  PID:2664

memory/2760-1-0x0000000000410000-0x0000000000465000-memory.dmp

Filesize
340KB

Download
memory/2760-0-0x00000000003B0000-0x000000000040A000-memory.dmp

Filesize
360KB

Download
memory/2760-2-0x0000000000260000-0x000000000033E000-memory.dmp

Filesize
888KB

Download