e9b143769d15da9077ba7df8182e77504ec9c75d580437c599bd0d5c5538b471

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:36

Target

269805319ac2ecf1ecc4b17f7f2165f1.exe
Size

40KB
MD5

269805319ac2ecf1ecc4b17f7f2165f1
SHA1

9ec6017a30a9f49dd397423d956048c31822c3c6
SHA256

e9b143769d15da9077ba7df8182e77504ec9c75d580437c599bd0d5c5538b471
SHA512

6d42344b955c3dd929385e2c3446ea4f548f82cdc7e6d2c7b4d8364a77d6afe4d99efbfecd76bde6fa9b7d183f3d0be8f63fd410a05d6f431835659aacc7f336
SSDEEP

768:hyQ7rvZxG6OePYeJ/2TMz3BWoG3ZmA6OHy1h6tlEzObYV12DXyCcyDI1F4:hT7TZWegeJ/2TMLooSnihelDMcXyC08

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1072-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1072-1-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	1072	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1288	1072	269805319ac2ecf1ecc4b17f7f2165f1.exe	28
PID 1072 wrote to memory of 1288	1072	269805319ac2ecf1ecc4b17f7f2165f1.exe	28
PID 1072 wrote to memory of 1288	1072	269805319ac2ecf1ecc4b17f7f2165f1.exe	28
PID 1072 wrote to memory of 1288	1072	269805319ac2ecf1ecc4b17f7f2165f1.exe	28

C:\Users\Admin\AppData\Local\Temp\269805319ac2ecf1ecc4b17f7f2165f1.exe
"C:\Users\Admin\AppData\Local\Temp\269805319ac2ecf1ecc4b17f7f2165f1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 88
  2⤵
  - Program crash
  PID:1288

memory/1072-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1072-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download