cb7b049cf38097ec7d39e9358a2084ef00bb564b335bb0966ff6feac74bfdf45

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:27

Target

1883341868ceb83e050d16682e3626ee.exe
Size

93KB
MD5

1883341868ceb83e050d16682e3626ee
SHA1

0f0f0b37d984128ce1010a1bce09fb6c25dde480
SHA256

cb7b049cf38097ec7d39e9358a2084ef00bb564b335bb0966ff6feac74bfdf45
SHA512

cca04797fba01e4d24f6cf78e6534539c8e081e07527db4e3202e2b820453547aad73506def5fd50d8c565448c028e5b4dd772b74d60ef7d6c1d810505e1a76a
SSDEEP

1536:phkiQe0MXCU/2UKHt32zsQHWdk2IywmN+ud0altxLbKBCwTO:kiQif+t3Sxh29wmNdd0XBCwTO

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2572	1883341868ceb83e050d16682e3626ee.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2572-0-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	2572	WerFault.exe	16

C:\Users\Admin\AppData\Local\Temp\1883341868ceb83e050d16682e3626ee.exe
"C:\Users\Admin\AppData\Local\Temp\1883341868ceb83e050d16682e3626ee.exe"
1⤵
- Loads dropped DLL
PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 336
  2⤵
  - Program crash
  PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2572 -ip 2572
1⤵
PID:668

memory/2572-1-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2572-6-0x0000000077E42000-0x0000000077E43000-memory.dmp

Filesize
4KB

Download
memory/2572-5-0x0000000077E42000-0x0000000077E43000-memory.dmp

Filesize
4KB

Download
memory/2572-2-0x0000000002180000-0x0000000002182000-memory.dmp

Filesize
8KB

Download
memory/2572-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download