1571a63616e7f27d15a77a543471850470910da8a01756b6c0ede4e4c14d7c27

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:21

Target

1854b902ff2a62f1b6362d3fcd1aa2fb.exe
Size

296KB
MD5

1854b902ff2a62f1b6362d3fcd1aa2fb
SHA1

d3eace956c49ccfa663ee3b1ee1ca110a917235d
SHA256

1571a63616e7f27d15a77a543471850470910da8a01756b6c0ede4e4c14d7c27
SHA512

e419e14210796686039f4f7663fb0ca366d78f22bb74a67f2be1d8d33e3087667e82d6a8577d8f4db0f1d9c0c3accca05428d48a5c48e445b4d8633b32fc8538
SSDEEP

6144:8N2uZ8tIResASM3FKo+Nj1Y2IR5GqvqT7WT3IptMtgzoS:c2uZ8t2eDL3FKoCFIm0BIwtmoS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2144-0-0x0000000000400000-0x0000000000497000-memory.dmp	upx
behavioral1/memory/2144-2-0x0000000000400000-0x0000000000497000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2144	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2524	2144	1854b902ff2a62f1b6362d3fcd1aa2fb.exe	28
PID 2144 wrote to memory of 2524	2144	1854b902ff2a62f1b6362d3fcd1aa2fb.exe	28
PID 2144 wrote to memory of 2524	2144	1854b902ff2a62f1b6362d3fcd1aa2fb.exe	28
PID 2144 wrote to memory of 2524	2144	1854b902ff2a62f1b6362d3fcd1aa2fb.exe	28

C:\Users\Admin\AppData\Local\Temp\1854b902ff2a62f1b6362d3fcd1aa2fb.exe
"C:\Users\Admin\AppData\Local\Temp\1854b902ff2a62f1b6362d3fcd1aa2fb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 192
  2⤵
  - Program crash
  PID:2524

memory/2144-0-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2144-1-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2144-2-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download