818abf3d836ea0e22ebce51e3b190106be08ec6bcba15f33f37afce012ccc180

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 06:23

Target

4fd21d498a23f6a4d50d84f43e08542c.exe
Size

59KB
MD5

4fd21d498a23f6a4d50d84f43e08542c
SHA1

d1ee83beee7b8f5b6b5e020a53c035395ea4e45b
SHA256

818abf3d836ea0e22ebce51e3b190106be08ec6bcba15f33f37afce012ccc180
SHA512

b40464204ffba2d962b913824d3944eb5f4e84de294e4053b7b9ce4385b971888ebe24d44d97e88779a566c8cc13e870b7407e2b99dae0c40f50ac32a1422039
SSDEEP

768:bFoWTi7VKJKT0OWs5TtWERYImI7YSNyPtGJiIf6hYyIGfMrSnshKubehypRl4TM0:5bT0QRs5TQxUGwf6bsr5Sh2Rl4h5z

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	2404	WerFault.exe	16

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2404	4fd21d498a23f6a4d50d84f43e08542c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2404	4fd21d498a23f6a4d50d84f43e08542c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2856	2404	4fd21d498a23f6a4d50d84f43e08542c.exe	28
PID 2404 wrote to memory of 2856	2404	4fd21d498a23f6a4d50d84f43e08542c.exe	28
PID 2404 wrote to memory of 2856	2404	4fd21d498a23f6a4d50d84f43e08542c.exe	28
PID 2404 wrote to memory of 2856	2404	4fd21d498a23f6a4d50d84f43e08542c.exe	28

C:\Users\Admin\AppData\Local\Temp\4fd21d498a23f6a4d50d84f43e08542c.exe
"C:\Users\Admin\AppData\Local\Temp\4fd21d498a23f6a4d50d84f43e08542c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 308
  2⤵
  - Program crash
  PID:2856

memory/2404-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2404-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2404-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2404-7-0x0000000077AC0000-0x0000000077AC1000-memory.dmp

Filesize
4KB

Download
memory/2404-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2404-9-0x00000000003D0000-0x00000000003DB000-memory.dmp

Filesize
44KB

Download
memory/2404-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2404-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2404-11-0x00000000003D0000-0x00000000003DB000-memory.dmp

Filesize
44KB

Download