bc2f44a9ff007f22b879107b65136729e884133a55a40aa5450eb74900657db9

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:15

Target

2997278414e197a28302ad9ea47eb268.exe
Size

18KB
MD5

2997278414e197a28302ad9ea47eb268
SHA1

c327c91f060ab3bfe86c5fc931052e5a12907e73
SHA256

bc2f44a9ff007f22b879107b65136729e884133a55a40aa5450eb74900657db9
SHA512

a8c23f8c4e1578ee66406b5e873cfc3552423a4bf19ac1362e15086872602ef61ce230847546f2cfdaeac15cc7b51feadc6a0493b45d92ff0485b87aa8ba798a
SSDEEP

384:UDU+ESh+Rs3pNaweGxiEV5N50bMAKfVQ9M7bIv6UGTnz/1Ro3:luh+RW44F5N5jAKfVQ9Mgv6FP90

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1300-2-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/1300-1-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral1/memory/1300-0-0x0000000010000000-0x0000000010011000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process
2312	1300	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2312	1300	2997278414e197a28302ad9ea47eb268.exe	16
PID 1300 wrote to memory of 2312	1300	2997278414e197a28302ad9ea47eb268.exe	16
PID 1300 wrote to memory of 2312	1300	2997278414e197a28302ad9ea47eb268.exe	16
PID 1300 wrote to memory of 2312	1300	2997278414e197a28302ad9ea47eb268.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 36
1⤵
- Program crash
PID:2312

C:\Users\Admin\AppData\Local\Temp\2997278414e197a28302ad9ea47eb268.exe
"C:\Users\Admin\AppData\Local\Temp\2997278414e197a28302ad9ea47eb268.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300

memory/1300-2-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1300-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1300-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download