7b73c3bca855daf40fbf1a978836025db5b2fd60f1116cd9bcda6d2d28d27df7

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 04:12

Target

47ff4b6c32e8c48a115aa9720162605c.exe
Size

54KB
MD5

47ff4b6c32e8c48a115aa9720162605c
SHA1

527d035120dbbb5dd8592ffb937a645a1894e1c7
SHA256

7b73c3bca855daf40fbf1a978836025db5b2fd60f1116cd9bcda6d2d28d27df7
SHA512

10bf3c58a2f8e6f2918e9ea01b0ac7ad1f6aa00a0be05b171258c4c4d7165c19f0e0f044573aa7e33e7c05739de31fc8ff1408969d5d83722646bb8a0846bc1b
SSDEEP

1536:B95BXlWDb9qzpzx+vctz8Svctz8Svctz8Svctz8Fvctz8Svctz8Svctz8Svctz8l:j5RlsRkpzNt8Lt8Lt8Lt8Gt8Lt8Lt8Lq

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1484-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1484-1-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	1484	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2288	1484	47ff4b6c32e8c48a115aa9720162605c.exe	28
PID 1484 wrote to memory of 2288	1484	47ff4b6c32e8c48a115aa9720162605c.exe	28
PID 1484 wrote to memory of 2288	1484	47ff4b6c32e8c48a115aa9720162605c.exe	28
PID 1484 wrote to memory of 2288	1484	47ff4b6c32e8c48a115aa9720162605c.exe	28

C:\Users\Admin\AppData\Local\Temp\47ff4b6c32e8c48a115aa9720162605c.exe
"C:\Users\Admin\AppData\Local\Temp\47ff4b6c32e8c48a115aa9720162605c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 96
  2⤵
  - Program crash
  PID:2288

memory/1484-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1484-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download