7fb42aa046e609fea1e2619140984a2f5b2afd6204505e85608dc9338d20ac3b

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 20:21

Target

65f2db5e3b1106f4199e97d27523d014.exe
Size

308KB
MD5

65f2db5e3b1106f4199e97d27523d014
SHA1

ceab4507d7f3928ae6a16e62e7687ec51e1e7b6b
SHA256

7fb42aa046e609fea1e2619140984a2f5b2afd6204505e85608dc9338d20ac3b
SHA512

30c662074936490fea111e86f85676e39297063d10dc21a84f13683ffdfd2161a02443b8f5ce25ca480b530b73d5cbc2b7e780eb48b9a3c99f37223bee202141
SSDEEP

6144:f60yLW4Z/OiwEdzFduwv/QVXbRfzEesSksOW7vQ6gS5IzVRD3OfoS:f60ya4MEdKNf/sDsOW7vQXS2zVRD3OfZ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2396-0-0x0000000000400000-0x00000000004D7000-memory.dmp	upx
behavioral1/memory/2396-2-0x0000000000400000-0x00000000004D7000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	2396	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2332	2396	65f2db5e3b1106f4199e97d27523d014.exe	28
PID 2396 wrote to memory of 2332	2396	65f2db5e3b1106f4199e97d27523d014.exe	28
PID 2396 wrote to memory of 2332	2396	65f2db5e3b1106f4199e97d27523d014.exe	28
PID 2396 wrote to memory of 2332	2396	65f2db5e3b1106f4199e97d27523d014.exe	28

C:\Users\Admin\AppData\Local\Temp\65f2db5e3b1106f4199e97d27523d014.exe
"C:\Users\Admin\AppData\Local\Temp\65f2db5e3b1106f4199e97d27523d014.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 180
  2⤵
  - Program crash
  PID:2332

memory/2396-0-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2396-1-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2396-2-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2396-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download