f0d819c4077168bf0d3c0238ded8878b5a2e84932b7b9f4c84924bc08c4fc4e4

Analysis

max time kernel
141s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:24

Target

26486a99730aba9555b7d3fe6d87e016.exe
Size

57KB
MD5

26486a99730aba9555b7d3fe6d87e016
SHA1

0c12fc99094043c31a73cb55c351e86187f46438
SHA256

f0d819c4077168bf0d3c0238ded8878b5a2e84932b7b9f4c84924bc08c4fc4e4
SHA512

c1d04307e52cd0c4ad9f842346b786a148aa560642fb7b19ac2739e372a2db83af6c9f8af7838f4918c21f434263958d5cb456145ad7df8d9ef776acf116748f
SSDEEP

768:gBK5iwGXOveNQ0vfmJY6rrkhccrbtWH/BKfBab9EnwMjozoXYmIrK46OBa:Q0kXmJYsQPUH/IXwMjo8Xj5CB

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1344-0-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1344-1-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	1344	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2904	1344	26486a99730aba9555b7d3fe6d87e016.exe	28
PID 1344 wrote to memory of 2904	1344	26486a99730aba9555b7d3fe6d87e016.exe	28
PID 1344 wrote to memory of 2904	1344	26486a99730aba9555b7d3fe6d87e016.exe	28
PID 1344 wrote to memory of 2904	1344	26486a99730aba9555b7d3fe6d87e016.exe	28

C:\Users\Admin\AppData\Local\Temp\26486a99730aba9555b7d3fe6d87e016.exe
"C:\Users\Admin\AppData\Local\Temp\26486a99730aba9555b7d3fe6d87e016.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 92
  2⤵
  - Program crash
  PID:2904

memory/1344-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1344-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download