68386c381353ab6e1d845cba973f92e09a1b23e1bb38b99f724635f40642e1f9

Analysis

max time kernel
145s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 07:52

Target

4327e2a71b1a64f82806d4332efdb508.exe
Size

249KB
MD5

4327e2a71b1a64f82806d4332efdb508
SHA1

05fa5725797768419fef04afb2efdd68de7ac285
SHA256

68386c381353ab6e1d845cba973f92e09a1b23e1bb38b99f724635f40642e1f9
SHA512

7a2a6fe41c575bab9e53ccde3d856e942c7c77834e3cf08584ecd794ae61377bdca255a6fcfea498efa65c9f479417ab82323397b13f808e6b8429acc4a68640
SSDEEP

6144:wFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsWH:4R72EqluswR45JTnaEY2WH

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2140-0-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/2140-1-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/2140-2-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1788	2140	WerFault.exe	37
1244	2140	WerFault.exe	37

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1788	2140	4327e2a71b1a64f82806d4332efdb508.exe	96
PID 2140 wrote to memory of 1788	2140	4327e2a71b1a64f82806d4332efdb508.exe	96
PID 2140 wrote to memory of 1788	2140	4327e2a71b1a64f82806d4332efdb508.exe	96

C:\Users\Admin\AppData\Local\Temp\4327e2a71b1a64f82806d4332efdb508.exe
"C:\Users\Admin\AppData\Local\Temp\4327e2a71b1a64f82806d4332efdb508.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 548
  2⤵
  - Program crash
  PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 548
  2⤵
  - Program crash
  PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2140 -ip 2140
1⤵
PID:2248

memory/2140-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2140-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2140-2-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download