f253927147d35810184840a16338f55b81db27846ef1b5485220483d67dd0707

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 05:51

Target

73e5c14996e307888c043d4b19b3051c.exe
Size

920KB
MD5

73e5c14996e307888c043d4b19b3051c
SHA1

d15a4e229895bc3c5dcd021bcf50ade5de99249e
SHA256

f253927147d35810184840a16338f55b81db27846ef1b5485220483d67dd0707
SHA512

23a03aceb0b5957fcb1cc077a1aff0385db9c33c4d52ae00b64d97957fe7e5e827c91400d407002c794533342871c6f78c912630f81f17f09a31c411fb22700a
SSDEEP

6144:WXiQ9L28XiQ9L2fRepeoG9tBhL1VstgBrGMe3UoVeJnB:Q56i56fUMFTBhL1VstZ3UoYJ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2896-1-0x0000000000400000-0x00000000004E6000-memory.dmp	upx
behavioral1/memory/2896-2-0x0000000000400000-0x00000000004E6000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	2896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2984	2896	73e5c14996e307888c043d4b19b3051c.exe	28
PID 2896 wrote to memory of 2984	2896	73e5c14996e307888c043d4b19b3051c.exe	28
PID 2896 wrote to memory of 2984	2896	73e5c14996e307888c043d4b19b3051c.exe	28
PID 2896 wrote to memory of 2984	2896	73e5c14996e307888c043d4b19b3051c.exe	28

C:\Users\Admin\AppData\Local\Temp\73e5c14996e307888c043d4b19b3051c.exe
"C:\Users\Admin\AppData\Local\Temp\73e5c14996e307888c043d4b19b3051c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 36
  2⤵
  - Program crash
  PID:2984

memory/2896-1-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2896-2-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download