e5a942f57c2ccb0fcb1797a245ace0e610658d6fa749b55382ba0c5317c88a9f

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:32

Target

2a1f1bf6d2f942353af1398d8995f8ee.exe
Size

458KB
MD5

2a1f1bf6d2f942353af1398d8995f8ee
SHA1

cbceeb6594c0d4ab06de61300524cfa0b631580f
SHA256

e5a942f57c2ccb0fcb1797a245ace0e610658d6fa749b55382ba0c5317c88a9f
SHA512

cd5aa7a9d8c516d26cf93940aa67c768fb94292a3d5e9ea1f121fa9e0a92ac9950bf711b84a4af2155b122efed4653ecf5ab5b36c9c62024e471c21a5759b3d3
SSDEEP

12288:rYLYclxLwWPnEkLBotYzexBAWHZl7K2mvS3QmE2QPs7ur:ra5lxLwWP7qGcAYsmNQPs7W

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x0000000000595000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	2888	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2892	2888	2a1f1bf6d2f942353af1398d8995f8ee.exe	16
PID 2888 wrote to memory of 2892	2888	2a1f1bf6d2f942353af1398d8995f8ee.exe	16
PID 2888 wrote to memory of 2892	2888	2a1f1bf6d2f942353af1398d8995f8ee.exe	16
PID 2888 wrote to memory of 2892	2888	2a1f1bf6d2f942353af1398d8995f8ee.exe	16

C:\Users\Admin\AppData\Local\Temp\2a1f1bf6d2f942353af1398d8995f8ee.exe
"C:\Users\Admin\AppData\Local\Temp\2a1f1bf6d2f942353af1398d8995f8ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 96
  2⤵
  - Program crash
  PID:2892

memory/2888-0-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download