6a5011b3d4e33794b3adce7497961be3737a5d1095dd128a4759dd9838114cc0

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:57

Target

38e5a534cab28b482bdcf0fbd0971df6.exe
Size

165KB
MD5

38e5a534cab28b482bdcf0fbd0971df6
SHA1

cee0a2423cecbe96c958c5874abcc4f2ec1a95f3
SHA256

6a5011b3d4e33794b3adce7497961be3737a5d1095dd128a4759dd9838114cc0
SHA512

836429d2ffecb614d0bd92bf3d3b5c5a51b0ea5c061b7a49eecce9ed39759f884b74fc5810c99a597098a2036af0c7693baff977f370ffef7174b0c1eb69e80e
SSDEEP

3072:NM7lv2IwuWaMfzJo+X/w7cBzxqnZbEtgsbadQfFMoUCkIvR0QlRunATmpFEPCaX:m7l4ucK0a+xqJE+WFM7vIvi0RDT0yPC+

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x0000000000461000-memory.dmp	upx
behavioral1/memory/2992-1-0x0000000000400000-0x0000000000461000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3036	2992	38e5a534cab28b482bdcf0fbd0971df6.exe	28
PID 2992 wrote to memory of 3036	2992	38e5a534cab28b482bdcf0fbd0971df6.exe	28
PID 2992 wrote to memory of 3036	2992	38e5a534cab28b482bdcf0fbd0971df6.exe	28
PID 2992 wrote to memory of 3036	2992	38e5a534cab28b482bdcf0fbd0971df6.exe	28

C:\Users\Admin\AppData\Local\Temp\38e5a534cab28b482bdcf0fbd0971df6.exe
"C:\Users\Admin\AppData\Local\Temp\38e5a534cab28b482bdcf0fbd0971df6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 96
  2⤵
  - Program crash
  PID:3036

memory/2992-0-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2992-1-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download