a73bf74ad6e1064bae65676feb50da619953869804c578fad45e468efe44e1a8

Analysis

max time kernel
172s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 04:26

Target

281c2e683cd34ffe27a3f4158cc694b2.exe
Size

32KB
MD5

281c2e683cd34ffe27a3f4158cc694b2
SHA1

03c613451d420bb0d47263a0d2d37fdd85dbebf8
SHA256

a73bf74ad6e1064bae65676feb50da619953869804c578fad45e468efe44e1a8
SHA512

4d4f1faed153c2a609e93ce08524392743dc251342c6fc0ddeabaee94becde11716815750d9acd3948b82ce61df67f918681b3698102f8c27f4c5923ce9b2956
SSDEEP

384:qWRG4HJzhJORMQ+rqENsNv3jgP/hHIqpDkiuiXte8Fb1/6qsv4AnCjNe9XaktPTD:M4HJzSKBqoYPS/fpVuiXk8F3kwCa0nPH

Score

7^/10

upx

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3776-0-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral2/memory/3776-1-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral2/memory/3776-2-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral2/memory/3776-3-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral2/memory/3776-6-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral2/memory/3776-10-0x0000000000010000-0x0000000000029000-memory.dmp	upx
behavioral2/memory/3776-17-0x0000000000010000-0x0000000000029000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Passepartout.exe	281c2e683cd34ffe27a3f4158cc694b2.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5020	3776	WerFault.exe	88
3492	3776	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 5020	3776	281c2e683cd34ffe27a3f4158cc694b2.exe	104
PID 3776 wrote to memory of 5020	3776	281c2e683cd34ffe27a3f4158cc694b2.exe	104
PID 3776 wrote to memory of 5020	3776	281c2e683cd34ffe27a3f4158cc694b2.exe	104

C:\Users\Admin\AppData\Local\Temp\281c2e683cd34ffe27a3f4158cc694b2.exe
"C:\Users\Admin\AppData\Local\Temp\281c2e683cd34ffe27a3f4158cc694b2.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 804
  2⤵
  - Program crash
  PID:5020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 804
  2⤵
  - Program crash
  PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3776 -ip 3776
1⤵
PID:4112

memory/3776-0-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/3776-1-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/3776-2-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/3776-3-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/3776-6-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/3776-10-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download
memory/3776-17-0x0000000000010000-0x0000000000029000-memory.dmp

Filesize
100KB

Download