e56d926c1b1e4f9370e1a1ef613d32fab180f0a3964e839dc4546987ca0bf451

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 05:01

Target

79565b5960420a244ad490d8ef39e533.exe
Size

308KB
MD5

79565b5960420a244ad490d8ef39e533
SHA1

21bb277715b51c116db1261484eaff8cb8a9d583
SHA256

e56d926c1b1e4f9370e1a1ef613d32fab180f0a3964e839dc4546987ca0bf451
SHA512

88d8eeb85c16639994d082801dd89b80b7b03e93e6981b1b126c8a409194cd067689b75a4b046b7b2150d1543bea03524fb21f56524a14dc2973dbd7bfcae51e
SSDEEP

6144:uP2bvKyCPkpBYR/z12rQ5QHZ5GABGjxgqKouFxajCgXiTEE19iDH:uP2bvO8PE/IQ5QHZ5GAw3juFxHdTEy92

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2536-0-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2536-3-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2536-2-0x0000000010000000-0x0000000010020000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2536	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2928	2536	79565b5960420a244ad490d8ef39e533.exe	28
PID 2536 wrote to memory of 2928	2536	79565b5960420a244ad490d8ef39e533.exe	28
PID 2536 wrote to memory of 2928	2536	79565b5960420a244ad490d8ef39e533.exe	28
PID 2536 wrote to memory of 2928	2536	79565b5960420a244ad490d8ef39e533.exe	28

C:\Users\Admin\AppData\Local\Temp\79565b5960420a244ad490d8ef39e533.exe
"C:\Users\Admin\AppData\Local\Temp\79565b5960420a244ad490d8ef39e533.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 116
  2⤵
  - Program crash
  PID:2928

memory/2536-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2536-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2536-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download