bdfa6cdc5d01d274aad088a53da9f798f158fee1ddc35cd570eac10310642386

Analysis

max time kernel
162s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 07:10

Target

2cd8ba63b780e6a4e651051b2bf174c6.exe
Size

84KB
MD5

2cd8ba63b780e6a4e651051b2bf174c6
SHA1

0fb82530dd1a17f8405bddb674161839f6cbf31c
SHA256

bdfa6cdc5d01d274aad088a53da9f798f158fee1ddc35cd570eac10310642386
SHA512

c3ca8232dbaacf65436d5ae1ee559b64218a491b968f95df6cf8aae8a9a9f5c96e69d914955d5e1d4d803169601a0cf5ef5a785742a27fb521656a69b8233db7
SSDEEP

1536:Na5IpcVpFh29J6MBEQRjasAwVSmr4HzJ5aza01F3AOg0xjjZvuONydt+DYDT:E2I8U89AwCH15aza08x0x/gld4UDT

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2736-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2736-1-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2736	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2628	2736	2cd8ba63b780e6a4e651051b2bf174c6.exe	28
PID 2736 wrote to memory of 2628	2736	2cd8ba63b780e6a4e651051b2bf174c6.exe	28
PID 2736 wrote to memory of 2628	2736	2cd8ba63b780e6a4e651051b2bf174c6.exe	28
PID 2736 wrote to memory of 2628	2736	2cd8ba63b780e6a4e651051b2bf174c6.exe	28

C:\Users\Admin\AppData\Local\Temp\2cd8ba63b780e6a4e651051b2bf174c6.exe
"C:\Users\Admin\AppData\Local\Temp\2cd8ba63b780e6a4e651051b2bf174c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 92
  2⤵
  - Program crash
  PID:2628

memory/2736-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2736-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download