5db3943cf6653385aec2985672d0a05c5ec562905a0d65d2e695e866d66bf128

Analysis

max time kernel
144s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:02

Target

37242ed27a0756d264bc0d09a4904548.exe
Size

31KB
MD5

37242ed27a0756d264bc0d09a4904548
SHA1

92d68bc05461390e9e065d0435c55a05986c9cce
SHA256

5db3943cf6653385aec2985672d0a05c5ec562905a0d65d2e695e866d66bf128
SHA512

2111ae607f086890538d636aeddb3deba550788bb14ba5af855fbdb7c7e9680922a0e3fac77f90dd4c5ae895f5a4c6d20f1fef00c1ea32e6d53ac302ef908371
SSDEEP

384:KNtkFnPF4xgxQdyEiiXwEmBlkcSv2Pk3ezlhQdy63bnTzWW/297pyYGqyHiMT:OWVPO4PmwE0icSRuzlsySvV2+YGb

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x000000000145E000-memory.dmp	upx
behavioral1/memory/2360-1-0x0000000000400000-0x000000000145E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	2360	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2432	2360	37242ed27a0756d264bc0d09a4904548.exe	28
PID 2360 wrote to memory of 2432	2360	37242ed27a0756d264bc0d09a4904548.exe	28
PID 2360 wrote to memory of 2432	2360	37242ed27a0756d264bc0d09a4904548.exe	28
PID 2360 wrote to memory of 2432	2360	37242ed27a0756d264bc0d09a4904548.exe	28

C:\Users\Admin\AppData\Local\Temp\37242ed27a0756d264bc0d09a4904548.exe
"C:\Users\Admin\AppData\Local\Temp\37242ed27a0756d264bc0d09a4904548.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 92
  2⤵
  - Program crash
  PID:2432

memory/2360-0-0x0000000000400000-0x000000000145E000-memory.dmp

Filesize
16.4MB

Download
memory/2360-1-0x0000000000400000-0x000000000145E000-memory.dmp

Filesize
16.4MB

Download