2d9758198feeb9809982b4c1e97b94d5d5b83cbd5a10127c4ff2d1cbb5248377

Analysis

max time kernel
156s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 23:08

Target

51dee5a95963dfef15da58bc75f5a90b.exe
Size

58KB
MD5

51dee5a95963dfef15da58bc75f5a90b
SHA1

f239813382856ed37f57ae698afefa19dc4db297
SHA256

2d9758198feeb9809982b4c1e97b94d5d5b83cbd5a10127c4ff2d1cbb5248377
SHA512

ec1157f55b6a14ba22a2938afe9f67f7437e0973d433683558a36c29efe3e28456db9989799e55a33204f00207e7f413beba623de56eb6c43d3e80f4844f4fca
SSDEEP

1536:ZIn2MZFIie/wctISQODvrHoKrDeMTGMD7Q/nnv2EWauZI:K2SFLeocBLrZTGtui+I

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4276-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/4276-1-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/4276-3-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4580	4276	WerFault.exe	89
4588	4276	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4580	4276	51dee5a95963dfef15da58bc75f5a90b.exe	97
PID 4276 wrote to memory of 4580	4276	51dee5a95963dfef15da58bc75f5a90b.exe	97
PID 4276 wrote to memory of 4580	4276	51dee5a95963dfef15da58bc75f5a90b.exe	97

C:\Users\Admin\AppData\Local\Temp\51dee5a95963dfef15da58bc75f5a90b.exe
"C:\Users\Admin\AppData\Local\Temp\51dee5a95963dfef15da58bc75f5a90b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 288
  2⤵
  - Program crash
  PID:4580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 288
  2⤵
  - Program crash
  PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4276 -ip 4276
1⤵
PID:1688

memory/4276-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4276-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4276-2-0x0000000002040000-0x0000000002042000-memory.dmp

Filesize
8KB

Download
memory/4276-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download