a22b35a5329a6a922f0e523862d8d080d05f18cb05232c1213c2404f9db70380

Analysis

max time kernel
150s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 07:20

Target

2d2540dd041990fe2f368dba183a7bea.exe
Size

515KB
MD5

2d2540dd041990fe2f368dba183a7bea
SHA1

3fc6bec1e2d9eece9ca42b27bbd2dbd2937edac4
SHA256

a22b35a5329a6a922f0e523862d8d080d05f18cb05232c1213c2404f9db70380
SHA512

cbfffaba91592fd7acd09a034b7d79508b140b2f3e6bb07a137d24c9d815598604e670b823586022cc9099cbcd211f8265150353c4a5c7ae1c3644e42557099a
SSDEEP

12288:C1CdM5gT0d6xYDz8g/19OTqLki/q2d5GmeIGxgXV:ZdMeT0d6xsH1UTqL5igMmeIvV

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2312-0-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/2312-1-0x0000000000400000-0x0000000000554000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2312	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2264	2312	2d2540dd041990fe2f368dba183a7bea.exe	28
PID 2312 wrote to memory of 2264	2312	2d2540dd041990fe2f368dba183a7bea.exe	28
PID 2312 wrote to memory of 2264	2312	2d2540dd041990fe2f368dba183a7bea.exe	28
PID 2312 wrote to memory of 2264	2312	2d2540dd041990fe2f368dba183a7bea.exe	28

C:\Users\Admin\AppData\Local\Temp\2d2540dd041990fe2f368dba183a7bea.exe
"C:\Users\Admin\AppData\Local\Temp\2d2540dd041990fe2f368dba183a7bea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 96
  2⤵
  - Program crash
  PID:2264

memory/2312-0-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2312-1-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download