5fe37f043118fb6748592efe724f76214c20f02b40143268e35fbbcf8f96160f

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 17:53

Target

65a8a87266a54ccf04a2de6c5d515899.exe
Size

2.9MB
MD5

65a8a87266a54ccf04a2de6c5d515899
SHA1

a47b1b5a1c7388e7c515b90148b0602b71dbfd45
SHA256

5fe37f043118fb6748592efe724f76214c20f02b40143268e35fbbcf8f96160f
SHA512

d291c31beb05b6f3128d0c55b22cb66ad530919244afa630c8b368e394e55e02e1d1855b8a346e12815333fd82b38e26cf0a581106f98049c3e1207d6d81cd88
SSDEEP

49152:UsFnQMUTkl62RMLhhUB6Nc8OgFUPTP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:UsQMIz2+LgBV8OgFcTgg3gnl/IVUs1jl

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1420-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/memory/1420-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1084	1420	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1084	1420	65a8a87266a54ccf04a2de6c5d515899.exe	28
PID 1420 wrote to memory of 1084	1420	65a8a87266a54ccf04a2de6c5d515899.exe	28
PID 1420 wrote to memory of 1084	1420	65a8a87266a54ccf04a2de6c5d515899.exe	28
PID 1420 wrote to memory of 1084	1420	65a8a87266a54ccf04a2de6c5d515899.exe	28

C:\Users\Admin\AppData\Local\Temp\65a8a87266a54ccf04a2de6c5d515899.exe
"C:\Users\Admin\AppData\Local\Temp\65a8a87266a54ccf04a2de6c5d515899.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 36
  2⤵
  - Program crash
  PID:1084

memory/1420-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1420-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download