54e8d447fc4bf8cad2ee76f37cf9fe87244fa5a2eee30b73d9bf0e8b119e3f59

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 00:30

Target

6401df864e1554915006fe6a4a20136d.exe
Size

9KB
MD5

6401df864e1554915006fe6a4a20136d
SHA1

896c0b8330ef9c506c796ff3f875c50530d492d0
SHA256

54e8d447fc4bf8cad2ee76f37cf9fe87244fa5a2eee30b73d9bf0e8b119e3f59
SHA512

8406c27766facab7c03f08bd4c446a7cd5adc6a82c6dbab9e7f7f845d136ff8a161810cfb82e42aa2e653c24391b5107c0a20ea11d8d7502c8b6d32838d44772
SSDEEP

96:oT9vxjUmt+ON41pp3j1DG8jCNdmhYyoRHHQOJnBUK0gln2F:oT9vxjUmt3SLG8jC6m3Jnln2F

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3036-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3036-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	3036	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3052	3036	6401df864e1554915006fe6a4a20136d.exe	28
PID 3036 wrote to memory of 3052	3036	6401df864e1554915006fe6a4a20136d.exe	28
PID 3036 wrote to memory of 3052	3036	6401df864e1554915006fe6a4a20136d.exe	28
PID 3036 wrote to memory of 3052	3036	6401df864e1554915006fe6a4a20136d.exe	28

C:\Users\Admin\AppData\Local\Temp\6401df864e1554915006fe6a4a20136d.exe
"C:\Users\Admin\AppData\Local\Temp\6401df864e1554915006fe6a4a20136d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 96
  2⤵
  - Program crash
  PID:3052

memory/3036-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3036-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download