e9375b5adc4269377d65b0d10708add6fd45b687645d76deafc113ef85f571ae | Triage

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 05:03

Sharing

Report Analysis Logs

General

Target

455b0c3bc3d7eaf4326141baf5c95939.exe
Size

109KB
MD5

455b0c3bc3d7eaf4326141baf5c95939
SHA1

d5cca65cdea80be61b89ca82bb465407126bffac
SHA256

e9375b5adc4269377d65b0d10708add6fd45b687645d76deafc113ef85f571ae
SHA512

227a563a62dec225942b82fa58ece2bdc0dbcde4432ff3bbfceb7e00570beba60ce4e2efce4588ffc356c51bbabbb6c53de6f53a07477ea9b3e5bcf791c82805
SSDEEP

3072:uwft8vdlWZNq9weSPMwHc0sBBgNGBUOduN8:zft8VwzmwhPMJ0sBBg4XkN8

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/2200-2-0x0000000000400000-0x0000000000452000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process
2140	2200	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2140	2200	455b0c3bc3d7eaf4326141baf5c95939.exe	15
PID 2200 wrote to memory of 2140	2200	455b0c3bc3d7eaf4326141baf5c95939.exe	15
PID 2200 wrote to memory of 2140	2200	455b0c3bc3d7eaf4326141baf5c95939.exe	15
PID 2200 wrote to memory of 2140	2200	455b0c3bc3d7eaf4326141baf5c95939.exe	15

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 156
1⤵
- Program crash
PID:2140

C:\Users\Admin\AppData\Local\Temp\455b0c3bc3d7eaf4326141baf5c95939.exe
"C:\Users\Admin\AppData\Local\Temp\455b0c3bc3d7eaf4326141baf5c95939.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-1-0x00000000003B0000-0x00000000003C2000-memory.dmp

Filesize
72KB

Download
memory/2200-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2200-2-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download