02f987eb41dfeb9f483d6839a267f6c69265660bd06d40e07721b04fb6ec8bfc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 04:14

Target

5c1b88b7568bf19c8b839ebdd9acf9a8.exe
Size

90KB
MD5

5c1b88b7568bf19c8b839ebdd9acf9a8
SHA1

a430e97f23f0b5478b455eee93ceee3c7e97d208
SHA256

02f987eb41dfeb9f483d6839a267f6c69265660bd06d40e07721b04fb6ec8bfc
SHA512

9b57b0f8b05fdcc7a6e6ce62cd360ec53786f97d1f1b0a16314b11c6f6692350e6bc90f58f47febd28bf803ddce4b9fefed66d64bb135e088437573f99b98d66
SSDEEP

1536:Fa4rFTk0brMtVdWkncmuavm1fhvrvg/C7/er6XXiu5tkYeLuwhvBXo9Kcmu7:QpTVdBuauthvrvNCWXXlrkYIlhvBY9G4

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3004-1-0x0000000000220000-0x00000000002A0000-memory.dmp	upx
behavioral1/memory/3004-2-0x0000000000220000-0x00000000002A0000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	3004	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3068	3004	5c1b88b7568bf19c8b839ebdd9acf9a8.exe	28
PID 3004 wrote to memory of 3068	3004	5c1b88b7568bf19c8b839ebdd9acf9a8.exe	28
PID 3004 wrote to memory of 3068	3004	5c1b88b7568bf19c8b839ebdd9acf9a8.exe	28
PID 3004 wrote to memory of 3068	3004	5c1b88b7568bf19c8b839ebdd9acf9a8.exe	28

C:\Users\Admin\AppData\Local\Temp\5c1b88b7568bf19c8b839ebdd9acf9a8.exe
"C:\Users\Admin\AppData\Local\Temp\5c1b88b7568bf19c8b839ebdd9acf9a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 124
  2⤵
  - Program crash
  PID:3068

memory/3004-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-1-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download
memory/3004-2-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download
memory/3004-3-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download