ec2b8b7329b020b1d730c15a4a9d52011ec94a7bf42468a03e6c20e059c43528

Analysis

max time kernel
150s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 17:38

Target

417eee87a3f306be1bf08bbd6e8f2900.exe
Size

151KB
MD5

417eee87a3f306be1bf08bbd6e8f2900
SHA1

92fc85807d10598e3dead95c874637e00cf811b9
SHA256

ec2b8b7329b020b1d730c15a4a9d52011ec94a7bf42468a03e6c20e059c43528
SHA512

f3894c9a89cfeab5e90a57512bc7ea2a2bf0686c86094bcccd1a11bacb116ffea0b573da01a551d4837e092f1e1dc95fab3758a120629151e419d4b12d85e182
SSDEEP

3072:6wV4OgSzBmh04eZFkz3Rr0gwGj9Tf8mH01LD8U/:6MzzILGFkzhr0pGj9omH01HN

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4652-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/4652-1-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4828	4652	WerFault.exe	87
1840	4652	WerFault.exe	87
4140	4652	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4828	4652	417eee87a3f306be1bf08bbd6e8f2900.exe	96
PID 4652 wrote to memory of 4828	4652	417eee87a3f306be1bf08bbd6e8f2900.exe	96
PID 4652 wrote to memory of 4828	4652	417eee87a3f306be1bf08bbd6e8f2900.exe	96

C:\Users\Admin\AppData\Local\Temp\417eee87a3f306be1bf08bbd6e8f2900.exe
"C:\Users\Admin\AppData\Local\Temp\417eee87a3f306be1bf08bbd6e8f2900.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 276
  2⤵
  - Program crash
  PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 276
  2⤵
  - Program crash
  PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 272
  2⤵
  - Program crash
  PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4652 -ip 4652
1⤵
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4652 -ip 4652
1⤵
PID:1188

memory/4652-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4652-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download