45c11004d3ca8fa1cc949620b331d9e6eb9566d1f28e317d9d799e3bf8faedb8

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 18:16

Target

3ab8efa76c0fcd1ead4c4ff60684b3e7.exe
Size

2.2MB
MD5

3ab8efa76c0fcd1ead4c4ff60684b3e7
SHA1

722b86be2a01b1f35a8e92c3f139f7c72d465a21
SHA256

45c11004d3ca8fa1cc949620b331d9e6eb9566d1f28e317d9d799e3bf8faedb8
SHA512

9e73d14d2888185db9622d87db9bf21896bdce90484b6c9c905641c2e060401657e7767a40282a237bd5614ff56c6baec9ad6db961eb6b26f073d0cfc58b58cf
SSDEEP

24576:klDnwKP5DQzgT/VrOBovqwSzozdAtBtSc2qY7Y+eD5y2LP5tKEg/nXXXLcDrs7BT:k9nwTzgxCEGSJQ+uve4D+T

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2032-0-0x0000000000400000-0x0000000000587000-memory.dmp	upx
behavioral1/memory/2032-1-0x0000000000400000-0x0000000000587000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2644	2032	3ab8efa76c0fcd1ead4c4ff60684b3e7.exe	28
PID 2032 wrote to memory of 2644	2032	3ab8efa76c0fcd1ead4c4ff60684b3e7.exe	28
PID 2032 wrote to memory of 2644	2032	3ab8efa76c0fcd1ead4c4ff60684b3e7.exe	28
PID 2032 wrote to memory of 2644	2032	3ab8efa76c0fcd1ead4c4ff60684b3e7.exe	28

C:\Users\Admin\AppData\Local\Temp\3ab8efa76c0fcd1ead4c4ff60684b3e7.exe
"C:\Users\Admin\AppData\Local\Temp\3ab8efa76c0fcd1ead4c4ff60684b3e7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 88
  2⤵
  - Program crash
  PID:2644

memory/2032-0-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2032-1-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download