4a2e855d2a17dd5c7278bff65f092a3ba882dcd36a658f23d8adf9bad118e356

Analysis

max time kernel
187s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 15:45

Target

50f8b8ec9e9de355702d4ec09d43b8bd.exe
Size

134KB
MD5

50f8b8ec9e9de355702d4ec09d43b8bd
SHA1

155e59059c1d50642d0e9a28fbdff8251e9fc34b
SHA256

4a2e855d2a17dd5c7278bff65f092a3ba882dcd36a658f23d8adf9bad118e356
SHA512

c42b0ff83eec60c52ab40c034bae8f8491d534c9434aadd0230a9ccec0a8a0a21413486eb5b9a837e2225ff464662b028a9e74ed2f3a63832df6c3998a672cdb
SSDEEP

3072:ZwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8STFiDHlHoBqPI:ZMzzILGFkzhr0pGj9o3HoAI

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3828-0-0x0000000000400000-0x0000000000498000-memory.dmp	upx
behavioral2/memory/3828-2-0x0000000000400000-0x0000000000498000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4020	3828	WerFault.exe	85
3464	3828	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4020	3828	50f8b8ec9e9de355702d4ec09d43b8bd.exe	92
PID 3828 wrote to memory of 4020	3828	50f8b8ec9e9de355702d4ec09d43b8bd.exe	92
PID 3828 wrote to memory of 4020	3828	50f8b8ec9e9de355702d4ec09d43b8bd.exe	92

C:\Users\Admin\AppData\Local\Temp\50f8b8ec9e9de355702d4ec09d43b8bd.exe
"C:\Users\Admin\AppData\Local\Temp\50f8b8ec9e9de355702d4ec09d43b8bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 264
  2⤵
  - Program crash
  PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 264
  2⤵
  - Program crash
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3828 -ip 3828
1⤵
PID:4092

memory/3828-0-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/3828-1-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/3828-2-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download