d3a4441b8da7789617bcb21b470b02060ddb049a9a23a9378b162d41acc41409

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:48

Target

2a9bdaf25e46a9d9f1dacb10cde3a753.exe
Size

43KB
MD5

2a9bdaf25e46a9d9f1dacb10cde3a753
SHA1

8d9fe841b3524497ab4eae1daaeae9736fe9edb7
SHA256

d3a4441b8da7789617bcb21b470b02060ddb049a9a23a9378b162d41acc41409
SHA512

540103d67d14c04bb7d1dd511779863aa2d42e4683a449d15f83da3ac85557effdf6095fb00d7173bf8f08840987ee0b835723019983f81e3912d37adbf44865
SSDEEP

192:t1c68D38fZsIR6f6eCF5dAjaGRLpchUDUwe8txLyc8I86JJ9d0k:t11fZBmCBxGdy+YwPxLaYr

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3064-0-0x0000000000400000-0x0000000000511000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process
2700	3064	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2700	3064	2a9bdaf25e46a9d9f1dacb10cde3a753.exe	16
PID 3064 wrote to memory of 2700	3064	2a9bdaf25e46a9d9f1dacb10cde3a753.exe	16
PID 3064 wrote to memory of 2700	3064	2a9bdaf25e46a9d9f1dacb10cde3a753.exe	16
PID 3064 wrote to memory of 2700	3064	2a9bdaf25e46a9d9f1dacb10cde3a753.exe	16

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 36
1⤵
- Program crash
PID:2700

C:\Users\Admin\AppData\Local\Temp\2a9bdaf25e46a9d9f1dacb10cde3a753.exe
"C:\Users\Admin\AppData\Local\Temp\2a9bdaf25e46a9d9f1dacb10cde3a753.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

memory/3064-0-0x0000000000400000-0x0000000000511000-memory.dmp

Filesize
1.1MB

Download