638a6e183eb1e5398bf2ca6c96fff8ef2228b024d634dfbc38304c0b5c5971cb

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 21:59

Target

54b13cab88fd97893a8ef9396fcf6777.exe
Size

46KB
MD5

54b13cab88fd97893a8ef9396fcf6777
SHA1

d3004a54dfddb798c34f633d20f30f29088699d0
SHA256

638a6e183eb1e5398bf2ca6c96fff8ef2228b024d634dfbc38304c0b5c5971cb
SHA512

f84f9c2420a083b026db1be8f81e73f77750554afd2d03f784a9044715e3fe64e890f857148879d459b2642f63ec4b81a58e3069d1c999e5b7c1fea99a4b5d4c
SSDEEP

768:RoMd/nJnfTmhAyLGJqm7o6Chb87xHQuzi+tQNB61XyLQFSa8PyHHJF8uyLQFvqeI:dhrVqmnChbmxwEQNMELASa8anX8JLAid

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2240	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2244	2240	54b13cab88fd97893a8ef9396fcf6777.exe	28
PID 2240 wrote to memory of 2244	2240	54b13cab88fd97893a8ef9396fcf6777.exe	28
PID 2240 wrote to memory of 2244	2240	54b13cab88fd97893a8ef9396fcf6777.exe	28
PID 2240 wrote to memory of 2244	2240	54b13cab88fd97893a8ef9396fcf6777.exe	28

C:\Users\Admin\AppData\Local\Temp\54b13cab88fd97893a8ef9396fcf6777.exe
"C:\Users\Admin\AppData\Local\Temp\54b13cab88fd97893a8ef9396fcf6777.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 36
  2⤵
  - Program crash
  PID:2244

memory/2240-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download