533368eb02c94a66d58f935ed6881d85402f61f65aca57146548690705fa38b0

Analysis

max time kernel
175s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:59

Target

257ea1ab485cdfc47dc60c912dcc78de.exe
Size

62KB
MD5

257ea1ab485cdfc47dc60c912dcc78de
SHA1

dd218ea37f98f253b8a9edf30519ac068a8f5a0d
SHA256

533368eb02c94a66d58f935ed6881d85402f61f65aca57146548690705fa38b0
SHA512

33a02737776820159a5304797fb7e861ba3941f07c07592a36bdc562092a0cfd9f562504d27ca049eabbe0fbc0e960dc54a50bfccde28e9434f3c60f4482ed2e
SSDEEP

1536:4nO6Ptz1J42zry9FSjxJQ26uSdoLFkk25:4HV1hGijvQ9j2Fbk

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2584-0-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/memory/2584-1-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	2584	WerFault.exe	19

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2584	257ea1ab485cdfc47dc60c912dcc78de.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	257ea1ab485cdfc47dc60c912dcc78de.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2716	2584	257ea1ab485cdfc47dc60c912dcc78de.exe	29
PID 2584 wrote to memory of 2716	2584	257ea1ab485cdfc47dc60c912dcc78de.exe	29
PID 2584 wrote to memory of 2716	2584	257ea1ab485cdfc47dc60c912dcc78de.exe	29
PID 2584 wrote to memory of 2716	2584	257ea1ab485cdfc47dc60c912dcc78de.exe	29

C:\Users\Admin\AppData\Local\Temp\257ea1ab485cdfc47dc60c912dcc78de.exe
"C:\Users\Admin\AppData\Local\Temp\257ea1ab485cdfc47dc60c912dcc78de.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 232
  2⤵
  - Program crash
  PID:2716

memory/2584-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2584-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download