64e800bae208c075a34fd707eff30dd7a1d3a655427a64e2755e7a3ba40ed9bb | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:32

Sharing

Report Analysis Logs

General

Target

382545c3668218a28a49fc498ceaa335.exe
Size

129KB
MD5

382545c3668218a28a49fc498ceaa335
SHA1

b6b6923f70a2d22150545299aedbc81c8987f6d5
SHA256

64e800bae208c075a34fd707eff30dd7a1d3a655427a64e2755e7a3ba40ed9bb
SHA512

5b07384a72d9cc3d434f680e25dff8cb3d06e8efa34888c443047e9d2efd480c231dbbf4040c3f8db90a788a72d123f5a22228ff7ebd35c05062f53228df1e30
SSDEEP

3072:nLpJiQ4mupZctQdajV/AiVfepKDX0SwiH0:LpJp41PcGIdzfe+X0dl

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1152-1-0x0000000000460000-0x00000000004E0000-memory.dmp	upx
behavioral1/memory/1152-2-0x0000000000460000-0x00000000004E0000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	1152	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2056	1152	382545c3668218a28a49fc498ceaa335.exe	18
PID 1152 wrote to memory of 2056	1152	382545c3668218a28a49fc498ceaa335.exe	18
PID 1152 wrote to memory of 2056	1152	382545c3668218a28a49fc498ceaa335.exe	18
PID 1152 wrote to memory of 2056	1152	382545c3668218a28a49fc498ceaa335.exe	18

C:\Users\Admin\AppData\Local\Temp\382545c3668218a28a49fc498ceaa335.exe
"C:\Users\Admin\AppData\Local\Temp\382545c3668218a28a49fc498ceaa335.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 124
  2⤵
  - Program crash
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1152-1-0x0000000000460000-0x00000000004E0000-memory.dmp

Filesize
512KB

Download
memory/1152-2-0x0000000000460000-0x00000000004E0000-memory.dmp

Filesize
512KB

Download
memory/1152-3-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download