68386c381353ab6e1d845cba973f92e09a1b23e1bb38b99f724635f40642e1f9

Analysis

max time kernel
184s
max time network
27s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 07:52

Target

4327e2a71b1a64f82806d4332efdb508.exe
Size

249KB
MD5

4327e2a71b1a64f82806d4332efdb508
SHA1

05fa5725797768419fef04afb2efdd68de7ac285
SHA256

68386c381353ab6e1d845cba973f92e09a1b23e1bb38b99f724635f40642e1f9
SHA512

7a2a6fe41c575bab9e53ccde3d856e942c7c77834e3cf08584ecd794ae61377bdca255a6fcfea498efa65c9f479417ab82323397b13f808e6b8429acc4a68640
SSDEEP

6144:wFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsWH:4R72EqluswR45JTnaEY2WH

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2840-0-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/2840-2-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2840	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2576	2840	4327e2a71b1a64f82806d4332efdb508.exe	29
PID 2840 wrote to memory of 2576	2840	4327e2a71b1a64f82806d4332efdb508.exe	29
PID 2840 wrote to memory of 2576	2840	4327e2a71b1a64f82806d4332efdb508.exe	29
PID 2840 wrote to memory of 2576	2840	4327e2a71b1a64f82806d4332efdb508.exe	29

C:\Users\Admin\AppData\Local\Temp\4327e2a71b1a64f82806d4332efdb508.exe
"C:\Users\Admin\AppData\Local\Temp\4327e2a71b1a64f82806d4332efdb508.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 220
  2⤵
  - Program crash
  PID:2576

memory/2840-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2840-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download