3a3f80f2909688886e94f59cc3d7d087017536cd5a1268c56011b8252cea4647

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 11:00

Target

40aeac77f5c853b90fffab4528528628.exe
Size

178KB
MD5

40aeac77f5c853b90fffab4528528628
SHA1

54ab669b6f238f121ccbdf43d462307f0003952c
SHA256

3a3f80f2909688886e94f59cc3d7d087017536cd5a1268c56011b8252cea4647
SHA512

97a942204f893e55fc286dfb4a42c8cace19791e18f928c84d60ffea6d4fadd29e1676bc48cc1b7fc930ef830edb04ba24d5941ee9139591be43c1a7a33f954b
SSDEEP

3072:RwV4OgSzBmh04eZFkz3Rr0g1Gj9Tf8EQdh0YlYpin7iwCkLUktIdKk++q:RMzzILGFkzhr0IGj9orr0YlYp89p

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x000000000046D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	2868	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3048	2868	40aeac77f5c853b90fffab4528528628.exe	28
PID 2868 wrote to memory of 3048	2868	40aeac77f5c853b90fffab4528528628.exe	28
PID 2868 wrote to memory of 3048	2868	40aeac77f5c853b90fffab4528528628.exe	28
PID 2868 wrote to memory of 3048	2868	40aeac77f5c853b90fffab4528528628.exe	28

C:\Users\Admin\AppData\Local\Temp\40aeac77f5c853b90fffab4528528628.exe
"C:\Users\Admin\AppData\Local\Temp\40aeac77f5c853b90fffab4528528628.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 88
  2⤵
  - Program crash
  PID:3048

memory/2868-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download