ae76bfb733249289dd40c0d12d7c82397a372d21d7925f0082236973effe9a1a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 03:07

Target

5a1d7de251f58482bcf542104a379940.exe
Size

88KB
MD5

5a1d7de251f58482bcf542104a379940
SHA1

6c74f79aeed4d974d5787c31da0567ea7756c21a
SHA256

ae76bfb733249289dd40c0d12d7c82397a372d21d7925f0082236973effe9a1a
SHA512

0fdec12357a2c1f15df42881920e52c8422f82f6a487a634ea825ec535a40d76f6f7c08f15848072fee7c0f2eac81cbf6fe61ce6467c6ecbe898154f1e112d28
SSDEEP

1536:WzbuB5BMDs7uPEQh7IDFZ92wGiZVLD+0WdpSlHmhYkm3JjVCPKsBcno7A:zBMQ8EQE92/i95WvSsBuVCtsiA

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/508-0-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral2/memory/508-3-0x0000000000400000-0x0000000000492000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3288	508	WerFault.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
508	5a1d7de251f58482bcf542104a379940.exe

C:\Users\Admin\AppData\Local\Temp\5a1d7de251f58482bcf542104a379940.exe
"C:\Users\Admin\AppData\Local\Temp\5a1d7de251f58482bcf542104a379940.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 464
  2⤵
  - Program crash
  PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 508 -ip 508
1⤵
PID:2328

memory/508-0-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/508-3-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download