eafa7504f43eb0afdfc07efb49783ee87d1e8a08c56d2c2a99421bbc8351de9f

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:24

Target

219b2a72ab2441177f4fa5d2adaa0a91.exe
Size

62KB
MD5

219b2a72ab2441177f4fa5d2adaa0a91
SHA1

a9259c0777fcffe78904a649d7299e1ac116c8b1
SHA256

eafa7504f43eb0afdfc07efb49783ee87d1e8a08c56d2c2a99421bbc8351de9f
SHA512

f2827aece9009f0413b1b7d93ce22f08f3883c76e184c89e8dae79e7c063e189b02f4b4b909565c6d94ef647a7b9e9c95b3604aa405d52afb26ad6709e165a01
SSDEEP

1536:6BUnWWYZ9UQo+BeNYFVqK1YClrqdqwN2QoJ7CFnd6VnQw:6Bx73Ro+BcCVqqYCli1O7CxEVnQw

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2996-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2996-3-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	2996	WerFault.exe	5

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3044	2996	219b2a72ab2441177f4fa5d2adaa0a91.exe	28
PID 2996 wrote to memory of 3044	2996	219b2a72ab2441177f4fa5d2adaa0a91.exe	28
PID 2996 wrote to memory of 3044	2996	219b2a72ab2441177f4fa5d2adaa0a91.exe	28
PID 2996 wrote to memory of 3044	2996	219b2a72ab2441177f4fa5d2adaa0a91.exe	28
PID 2996 wrote to memory of 3044	2996	219b2a72ab2441177f4fa5d2adaa0a91.exe	28
PID 2996 wrote to memory of 3044	2996	219b2a72ab2441177f4fa5d2adaa0a91.exe	28
PID 2996 wrote to memory of 3044	2996	219b2a72ab2441177f4fa5d2adaa0a91.exe	28

C:\Users\Admin\AppData\Local\Temp\219b2a72ab2441177f4fa5d2adaa0a91.exe
"C:\Users\Admin\AppData\Local\Temp\219b2a72ab2441177f4fa5d2adaa0a91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 256
  2⤵
  - Program crash
  PID:3044

memory/2996-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-1-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/2996-2-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/2996-3-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-6-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download
memory/2996-7-0x0000000000230000-0x000000000025B000-memory.dmp

Filesize
172KB

Download