e5ddb5ce0f93a306d145d6b538baee1c5c69358119ff8d73c5361842e4c87e54

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:40

Target

751e7c92ab587331580fa7d937d86f77.exe
Size

37KB
MD5

751e7c92ab587331580fa7d937d86f77
SHA1

d734206c876ac3cd6772f417fa847bbead4aad15
SHA256

e5ddb5ce0f93a306d145d6b538baee1c5c69358119ff8d73c5361842e4c87e54
SHA512

8e1ea275595092b52207ab8514db426b0234c440e0754cedee26f931021af8efaf91619c434a1c33a20218bda71d673814d33517321d850f2877da0a5acffdd3
SSDEEP

768:z75/aGyynklYAZBYCj+crRUsVTvFmyP/SLm3XVxgfYBBXwHgTP4Xt:35/hyyk7Bdjx1UETvzP/NVxmA8Qw9

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1972-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1972-1-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1736 1972 WerFault.exe 751e7c92ab587331580fa7d937d86f77.exe

pid	pid_target	process	target process
1736	1972	WerFault.exe	751e7c92ab587331580fa7d937d86f77.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

751e7c92ab587331580fa7d937d86f77.exe

description	pid	process	target process
PID 1972 wrote to memory of 1736	1972	751e7c92ab587331580fa7d937d86f77.exe	WerFault.exe
PID 1972 wrote to memory of 1736	1972	751e7c92ab587331580fa7d937d86f77.exe	WerFault.exe
PID 1972 wrote to memory of 1736	1972	751e7c92ab587331580fa7d937d86f77.exe	WerFault.exe
PID 1972 wrote to memory of 1736	1972	751e7c92ab587331580fa7d937d86f77.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\751e7c92ab587331580fa7d937d86f77.exe
"C:\Users\Admin\AppData\Local\Temp\751e7c92ab587331580fa7d937d86f77.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 116
2⤵
- Program crash
PID:1736

memory/1972-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1972-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download