acc75b97c44c074c302f287fabb1b1ced50bb08ac01cf0281b9d5b6a27befac3

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 10:44

Target

7205dcffb1696a4c427ad4eb2cf6b4a2.exe
Size

19KB
MD5

7205dcffb1696a4c427ad4eb2cf6b4a2
SHA1

bca3708cc028d5f541579839448b32bb81ee9f6c
SHA256

acc75b97c44c074c302f287fabb1b1ced50bb08ac01cf0281b9d5b6a27befac3
SHA512

e0ab2d4f4ce30d277d66b64da1da56de0d914506436cf4511b60f0b2062d5582dc9321ca5a3597c2f40bd9d9a7462c8e24731e9edb27fc4112679a7bd4b5f749
SSDEEP

384:m9aHrWRiM1Z3Wq6JVYNCA1BDrYLR7PcThAsQ3/z7Q+sQUADQ:wwrWgM1kjYNLTIR7EThAsQ3r7Q+Xjs

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/240-1-0x0000000010000000-0x0000000010012000-memory.dmp	upx
behavioral1/memory/240-2-0x0000000010000000-0x0000000010012000-memory.dmp	upx
behavioral1/memory/240-3-0x0000000010000000-0x0000000010012000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	240	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 2896	240	7205dcffb1696a4c427ad4eb2cf6b4a2.exe	28
PID 240 wrote to memory of 2896	240	7205dcffb1696a4c427ad4eb2cf6b4a2.exe	28
PID 240 wrote to memory of 2896	240	7205dcffb1696a4c427ad4eb2cf6b4a2.exe	28
PID 240 wrote to memory of 2896	240	7205dcffb1696a4c427ad4eb2cf6b4a2.exe	28

C:\Users\Admin\AppData\Local\Temp\7205dcffb1696a4c427ad4eb2cf6b4a2.exe
"C:\Users\Admin\AppData\Local\Temp\7205dcffb1696a4c427ad4eb2cf6b4a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 36
  2⤵
  - Program crash
  PID:2896

memory/240-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/240-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/240-3-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download