9ce7e6f4ec1030156b758925a5fd9db823844c57b4b697fe2cc4115082cb745a

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:02

Target

2755cfe7b8103befdfebc2f989eeb64a.exe
Size

159KB
MD5

2755cfe7b8103befdfebc2f989eeb64a
SHA1

2e4d1d988649850a5876e12b69f95bf5bf68cddc
SHA256

9ce7e6f4ec1030156b758925a5fd9db823844c57b4b697fe2cc4115082cb745a
SHA512

085b6f4ddfcab7fceb763425bbfcdcef8ad36502b5e9351c6ea59fccce06ef7683d0843deef1230806488bbf1cac465d918c27c1c9f0a80bbea7b209f94c8779
SSDEEP

3072:FfvtqnKNfjFbelJhkTPwSjGY8B1ylLY/aZZE8SC6c3QaIZGJGqzGg:FNqgrtKJhkwSjGYIQ9Y2ZEzC6cgaIQL

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral1/memory/2040-1-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1292	2040	2755cfe7b8103befdfebc2f989eeb64a.exe	28
PID 2040 wrote to memory of 1292	2040	2755cfe7b8103befdfebc2f989eeb64a.exe	28
PID 2040 wrote to memory of 1292	2040	2755cfe7b8103befdfebc2f989eeb64a.exe	28
PID 2040 wrote to memory of 1292	2040	2755cfe7b8103befdfebc2f989eeb64a.exe	28

C:\Users\Admin\AppData\Local\Temp\2755cfe7b8103befdfebc2f989eeb64a.exe
"C:\Users\Admin\AppData\Local\Temp\2755cfe7b8103befdfebc2f989eeb64a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 128
  2⤵
  - Program crash
  PID:1292

memory/2040-0-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2040-1-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download