4ad4ec32530d72555277de6d497cdc43c3153848d1e79f669d2364f2d0a7751e

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:30

Target

2489c49c858925cc72a2a77a2a2a112e.exe
Size

87KB
MD5

2489c49c858925cc72a2a77a2a2a112e
SHA1

249b196d4cb00427c771378b52bd79e056c4f98f
SHA256

4ad4ec32530d72555277de6d497cdc43c3153848d1e79f669d2364f2d0a7751e
SHA512

22294a75147ddf8966103bb841aea0a1d42bd23650140619b3e93521f12322607f050869363b7de6e0cd9a047b92e035609fbf1e6ab1e86d93e3ec22b0e3c20f
SSDEEP

1536:ArHCGTWTy7NLUx3u6sepZjCNH7nVEQmDjl3TTLfbieUena4oUP4j5+7tyn:8iwpUx3QeypnnQJTjTUj414T

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2112-0-0x0000000013140000-0x000000001315D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2112	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2124	2112	2489c49c858925cc72a2a77a2a2a112e.exe	16
PID 2112 wrote to memory of 2124	2112	2489c49c858925cc72a2a77a2a2a112e.exe	16
PID 2112 wrote to memory of 2124	2112	2489c49c858925cc72a2a77a2a2a112e.exe	16
PID 2112 wrote to memory of 2124	2112	2489c49c858925cc72a2a77a2a2a112e.exe	16

C:\Users\Admin\AppData\Local\Temp\2489c49c858925cc72a2a77a2a2a112e.exe
"C:\Users\Admin\AppData\Local\Temp\2489c49c858925cc72a2a77a2a2a112e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 36
  2⤵
  - Program crash
  PID:2124

memory/2112-0-0x0000000013140000-0x000000001315D000-memory.dmp

Filesize
116KB

Download