ecc923a41064cb1c3748e0193f4bf8ec0834ac6c1e578b97368af752b54b0906

Analysis

max time kernel
177s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 06:14

Target

3c19135da61af55604249e8dbf789b96.exe
Size

18KB
MD5

3c19135da61af55604249e8dbf789b96
SHA1

e00bf3ab34bec1b93cd92479209c8b4acf169e7e
SHA256

ecc923a41064cb1c3748e0193f4bf8ec0834ac6c1e578b97368af752b54b0906
SHA512

0a3f941ab39f431bb5a9dcf6eaf40b45e9c17b1375b7914d21dc5d7097c37c028a9103b6b00963dbd5adc25c837a4d1c9ebd0d7e939c72f4ff9c4dc92a671ebc
SSDEEP

384:EaVSYHK5lIy45zANk571igjS7GX5KQQN3tAQJvjNn4/xWci9DWm:EaDHK5nBy107GX5OtjxNn46

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2644-0-0x0000000006380000-0x000000000639C000-memory.dmp	upx
behavioral1/memory/2644-1-0x0000000006380000-0x000000000639C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	2644	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2096	2644	3c19135da61af55604249e8dbf789b96.exe	30
PID 2644 wrote to memory of 2096	2644	3c19135da61af55604249e8dbf789b96.exe	30
PID 2644 wrote to memory of 2096	2644	3c19135da61af55604249e8dbf789b96.exe	30
PID 2644 wrote to memory of 2096	2644	3c19135da61af55604249e8dbf789b96.exe	30

C:\Users\Admin\AppData\Local\Temp\3c19135da61af55604249e8dbf789b96.exe
"C:\Users\Admin\AppData\Local\Temp\3c19135da61af55604249e8dbf789b96.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 100
  2⤵
  - Program crash
  PID:2096

memory/2644-0-0x0000000006380000-0x000000000639C000-memory.dmp

Filesize
112KB

Download
memory/2644-1-0x0000000006380000-0x000000000639C000-memory.dmp

Filesize
112KB

Download