5e999e396c28b43b51c2d8287c62d772f298e4d23460cce067e89b866ec221be

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 19:26

Target

6871a50ba5ca8d53f0728644f6811c03.exe
Size

89KB
MD5

6871a50ba5ca8d53f0728644f6811c03
SHA1

2248cf8d926256fc6e942079401aef50006705fd
SHA256

5e999e396c28b43b51c2d8287c62d772f298e4d23460cce067e89b866ec221be
SHA512

8506c5e5fc3c51f276ee9d21b05f1af38d465255e5d0e5adf04031cdd034b0f09f59b65fae20c8dd733a1d85dd799f1f6a45351875b8f1fa7bc21896b5b2d59b
SSDEEP

96:0ZcagFNfSl/SU3sL06NUGDPQpZOn5z2oDDpE1sal2cqw:0ZX6N2q+9PM3D2sal2cqw

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	1976	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2468	1976	6871a50ba5ca8d53f0728644f6811c03.exe	28
PID 1976 wrote to memory of 2468	1976	6871a50ba5ca8d53f0728644f6811c03.exe	28
PID 1976 wrote to memory of 2468	1976	6871a50ba5ca8d53f0728644f6811c03.exe	28
PID 1976 wrote to memory of 2468	1976	6871a50ba5ca8d53f0728644f6811c03.exe	28

C:\Users\Admin\AppData\Local\Temp\6871a50ba5ca8d53f0728644f6811c03.exe
"C:\Users\Admin\AppData\Local\Temp\6871a50ba5ca8d53f0728644f6811c03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 36
  2⤵
  - Program crash
  PID:2468

memory/1976-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download