f5d2a8940cf0a57f1ccb0f98a309168188338358d93d40194253d10942e820ca | Triage

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 17:26

Sharing

Report Analysis Logs

General

Target

3d70fe5b9d3203d346b6349c124c8253.exe
Size

7KB
MD5

3d70fe5b9d3203d346b6349c124c8253
SHA1

aaebd55533eb9037cf65043ef393c1dab3c9b981
SHA256

f5d2a8940cf0a57f1ccb0f98a309168188338358d93d40194253d10942e820ca
SHA512

53db86280df8822c828ec0cc42fce03c5b3aa158a05845876e2be3364cb1c18140ffaa6a824af97062192fd9b7f1927890d80d79edf16624ef927d738175ef7b
SSDEEP

192:Y8b0N52bNAMWr006C9/ckvh5wzTiZUCZAugC:YWIMWr0beEkbwz9CZA

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2504-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	2504	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2008	2504	3d70fe5b9d3203d346b6349c124c8253.exe	28
PID 2504 wrote to memory of 2008	2504	3d70fe5b9d3203d346b6349c124c8253.exe	28
PID 2504 wrote to memory of 2008	2504	3d70fe5b9d3203d346b6349c124c8253.exe	28
PID 2504 wrote to memory of 2008	2504	3d70fe5b9d3203d346b6349c124c8253.exe	28

C:\Users\Admin\AppData\Local\Temp\3d70fe5b9d3203d346b6349c124c8253.exe
"C:\Users\Admin\AppData\Local\Temp\3d70fe5b9d3203d346b6349c124c8253.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 96
  2⤵
  - Program crash
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download