3054d3223bec892b82d370a98666bf5a2c09c5606685b64551ec8d4865d50135

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:28

Target

4d9666e18b23e9683eb13c6974ff6db3.exe
Size

778KB
MD5

4d9666e18b23e9683eb13c6974ff6db3
SHA1

e3ae6db91e1105e74044b3d3b57a3ed7014fd1d3
SHA256

3054d3223bec892b82d370a98666bf5a2c09c5606685b64551ec8d4865d50135
SHA512

e17dc8c73b00f6a7a6976f5414eb80e5adaaad8f522bb883f32faec1fc2c17b29c7067893d6f616a7311dca40c2d409e78c0eeb29831cc65bcd046f6927602b6
SSDEEP

12288:ApSrV2v2Aa+BwvHOfbUrDyGo25tLC/nHKG/bBx3xG2idAoi4zOAXx0cixa5EW:ApqAkHOfbUwI6q61G/AhAXxAxa5F

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1896-3-0x0000000000400000-0x000000000063D000-memory.dmp	upx
behavioral1/memory/1896-4-0x0000000000400000-0x000000000063D000-memory.dmp	upx
behavioral1/memory/1896-1-0x0000000000400000-0x000000000063D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	1896	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2716	1896	4d9666e18b23e9683eb13c6974ff6db3.exe	15
PID 1896 wrote to memory of 2716	1896	4d9666e18b23e9683eb13c6974ff6db3.exe	15
PID 1896 wrote to memory of 2716	1896	4d9666e18b23e9683eb13c6974ff6db3.exe	15
PID 1896 wrote to memory of 2716	1896	4d9666e18b23e9683eb13c6974ff6db3.exe	15

C:\Users\Admin\AppData\Local\Temp\4d9666e18b23e9683eb13c6974ff6db3.exe
"C:\Users\Admin\AppData\Local\Temp\4d9666e18b23e9683eb13c6974ff6db3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 132
  2⤵
  - Program crash
  PID:2716

memory/1896-3-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1896-4-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1896-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1896-1-0x0000000000400000-0x000000000063D000-memory.dmp

Filesize
2.2MB

Download
memory/1896-0-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1896-6-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1896-8-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download