7dd5241d683088f94f8f3365b57ed9371dd1b3812a2409882bbf0743e617513f

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:00

Target

20e36f88e90d3f4dfe1302cc8b5d48c0.exe
Size

59KB
MD5

20e36f88e90d3f4dfe1302cc8b5d48c0
SHA1

a68c17bd22b7a7b2282bde205853336f4c1061ca
SHA256

7dd5241d683088f94f8f3365b57ed9371dd1b3812a2409882bbf0743e617513f
SHA512

91706e56c54183eebbe1977f604df0b2811e2d9667d13eda93fdd88e1924fa75217c1a3a47eb2dcc0e32550c183274e8a9999ef51e6a40d36fa97d5951d51237
SSDEEP

768:PFoWTi7VKJKT0OWs5TtWERYImI7YSNyPtGJiIf6hYyIGfMrSnshKubehypRl4TM0:dbT0QRs5TQxUGwf6bsr5Sh2Rl4h5z

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	2276	WerFault.exe	17

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2276	20e36f88e90d3f4dfe1302cc8b5d48c0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2276	20e36f88e90d3f4dfe1302cc8b5d48c0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2780	2276	20e36f88e90d3f4dfe1302cc8b5d48c0.exe	27
PID 2276 wrote to memory of 2780	2276	20e36f88e90d3f4dfe1302cc8b5d48c0.exe	27
PID 2276 wrote to memory of 2780	2276	20e36f88e90d3f4dfe1302cc8b5d48c0.exe	27
PID 2276 wrote to memory of 2780	2276	20e36f88e90d3f4dfe1302cc8b5d48c0.exe	27

C:\Users\Admin\AppData\Local\Temp\20e36f88e90d3f4dfe1302cc8b5d48c0.exe
"C:\Users\Admin\AppData\Local\Temp\20e36f88e90d3f4dfe1302cc8b5d48c0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 308
  2⤵
  - Program crash
  PID:2780

memory/2276-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2276-1-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2276-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2276-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2276-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2276-7-0x0000000077B80000-0x0000000077B81000-memory.dmp

Filesize
4KB

Download
memory/2276-9-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/2276-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2276-11-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download