ade7221c629ca0568dc1742c1fad3eb4b73ae3ca7256d8e6b5656be985abc04a

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 13:19

Target

4e68a5dd4d3d1e48e82bc4cf0a118c70.exe
Size

838KB
MD5

4e68a5dd4d3d1e48e82bc4cf0a118c70
SHA1

de7be80466732012cbe014cf2b1df9d0a47e3c02
SHA256

ade7221c629ca0568dc1742c1fad3eb4b73ae3ca7256d8e6b5656be985abc04a
SHA512

3d064de8beb040c17a232213afdd1893faef7838dd08d90f4d2eb65381c5c4d674776ebe20811549c86fc8c88a8c06b3cfe72d248ee9bb9889f01e4059d28edb
SSDEEP

12288:21kx4IQVZmbUpczRWAlo2R4ePcW6s5ZmsLKKRtoRahN1zPFkMgI:6kKVuUURflBb01zKtRXC7I

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2136-0-0x0000000063400000-0x0000000063464000-memory.dmp	upx
behavioral1/memory/2136-1-0x0000000063400000-0x0000000063464000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	2136	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2000	2136	4e68a5dd4d3d1e48e82bc4cf0a118c70.exe	28
PID 2136 wrote to memory of 2000	2136	4e68a5dd4d3d1e48e82bc4cf0a118c70.exe	28
PID 2136 wrote to memory of 2000	2136	4e68a5dd4d3d1e48e82bc4cf0a118c70.exe	28
PID 2136 wrote to memory of 2000	2136	4e68a5dd4d3d1e48e82bc4cf0a118c70.exe	28

C:\Users\Admin\AppData\Local\Temp\4e68a5dd4d3d1e48e82bc4cf0a118c70.exe
"C:\Users\Admin\AppData\Local\Temp\4e68a5dd4d3d1e48e82bc4cf0a118c70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 124
  2⤵
  - Program crash
  PID:2000

memory/2136-0-0x0000000063400000-0x0000000063464000-memory.dmp

Filesize
400KB

Download
memory/2136-1-0x0000000063400000-0x0000000063464000-memory.dmp

Filesize
400KB

Download