ae76bfb733249289dd40c0d12d7c82397a372d21d7925f0082236973effe9a1a

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 03:07

Target

5a1d7de251f58482bcf542104a379940.exe
Size

88KB
MD5

5a1d7de251f58482bcf542104a379940
SHA1

6c74f79aeed4d974d5787c31da0567ea7756c21a
SHA256

ae76bfb733249289dd40c0d12d7c82397a372d21d7925f0082236973effe9a1a
SHA512

0fdec12357a2c1f15df42881920e52c8422f82f6a487a634ea825ec535a40d76f6f7c08f15848072fee7c0f2eac81cbf6fe61ce6467c6ecbe898154f1e112d28
SSDEEP

1536:WzbuB5BMDs7uPEQh7IDFZ92wGiZVLD+0WdpSlHmhYkm3JjVCPKsBcno7A:zBMQ8EQE92/i95WvSsBuVCtsiA

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1384-0-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral1/memory/1384-3-0x0000000000400000-0x0000000000492000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1148	1384	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1384	5a1d7de251f58482bcf542104a379940.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1148	1384	5a1d7de251f58482bcf542104a379940.exe	28
PID 1384 wrote to memory of 1148	1384	5a1d7de251f58482bcf542104a379940.exe	28
PID 1384 wrote to memory of 1148	1384	5a1d7de251f58482bcf542104a379940.exe	28
PID 1384 wrote to memory of 1148	1384	5a1d7de251f58482bcf542104a379940.exe	28

C:\Users\Admin\AppData\Local\Temp\5a1d7de251f58482bcf542104a379940.exe
"C:\Users\Admin\AppData\Local\Temp\5a1d7de251f58482bcf542104a379940.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 188
  2⤵
  - Program crash
  PID:1148

memory/1384-0-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1384-3-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download