f7f940215146913bbaa53c781a9930b5221980bddeaa6af57b809983eb21d6c4 | Triage

Analysis

max time kernel
141s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3884ecb905e2ed1c8e06d2a890c8e350.exe
Size

105KB
MD5

3884ecb905e2ed1c8e06d2a890c8e350
SHA1

3eaf87df0372607864afdddb3a6dfb506faca0f0
SHA256

f7f940215146913bbaa53c781a9930b5221980bddeaa6af57b809983eb21d6c4
SHA512

7f59ee68ed9224e767590351b1c390404464e16837b78a96db0ced8d7a3e46a605940820e1df121cd962970c32d95af2c7943025701cdd5d884817c003fa8d18
SSDEEP

3072:3PKzViM/Q7wDf4EHcy2i1dmKtslQOdzr7EcLDY:3PUVisgE92YBuzcc3Y

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1636-0-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1636-1-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1636-2-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	1636	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2704	1636	3884ecb905e2ed1c8e06d2a890c8e350.exe	28
PID 1636 wrote to memory of 2704	1636	3884ecb905e2ed1c8e06d2a890c8e350.exe	28
PID 1636 wrote to memory of 2704	1636	3884ecb905e2ed1c8e06d2a890c8e350.exe	28
PID 1636 wrote to memory of 2704	1636	3884ecb905e2ed1c8e06d2a890c8e350.exe	28

C:\Users\Admin\AppData\Local\Temp\3884ecb905e2ed1c8e06d2a890c8e350.exe
"C:\Users\Admin\AppData\Local\Temp\3884ecb905e2ed1c8e06d2a890c8e350.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 48
  2⤵
  - Program crash
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1636-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1636-2-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download