3eca0ea2ef9696d050838b556e357f1d34a18562aec19839e41cb29f17647217

Analysis

max time kernel
150s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 03:50

Target

26f9e6ff342ba45c6d5de6ceb27cf1b4.exe
Size

303KB
MD5

26f9e6ff342ba45c6d5de6ceb27cf1b4
SHA1

39054bab50ddac89d5c5126aa5ae41e91e990b72
SHA256

3eca0ea2ef9696d050838b556e357f1d34a18562aec19839e41cb29f17647217
SHA512

421d75596b304f053cfd2c85b5d1eccef33c27d5f5c63d8dbace82fff0582c8b65cd623e57d056f9d141b508442c623cb7e13de21ba44d302a81fefc7e546bc2
SSDEEP

6144:zFHbemuvH6nLZ4WxmQAx83gAldyZcoB/NCe0glgIMR7wi:BHbedvaLuUmQAu3Do2W4glS

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4292-12-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4292-13-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral2/memory/4292-14-0x0000000000400000-0x000000000046D000-memory.dmp	upx

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3620	4292	WerFault.exe	89
3456	4292	WerFault.exe	89
3856	4292	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3620	4292	26f9e6ff342ba45c6d5de6ceb27cf1b4.exe	98
PID 4292 wrote to memory of 3620	4292	26f9e6ff342ba45c6d5de6ceb27cf1b4.exe	98
PID 4292 wrote to memory of 3620	4292	26f9e6ff342ba45c6d5de6ceb27cf1b4.exe	98

C:\Users\Admin\AppData\Local\Temp\26f9e6ff342ba45c6d5de6ceb27cf1b4.exe
"C:\Users\Admin\AppData\Local\Temp\26f9e6ff342ba45c6d5de6ceb27cf1b4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 568
  2⤵
  - Program crash
  PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 568
  2⤵
  - Program crash
  PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 588
  2⤵
  - Program crash
  PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4292 -ip 4292
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4292 -ip 4292
1⤵
PID:3324

memory/4292-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4292-1-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4292-3-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-5-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-4-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-2-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-6-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4292-7-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-8-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-9-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-10-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-11-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/4292-12-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4292-13-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4292-14-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4292-15-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download