157ed1654d7b6a6166a05e634c0df2785599086fda6e773ea7a723cfb3496668

Analysis

max time kernel
108s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 15:43

Target

7aa2f47d3b960b717993b338705f442b.exe
Size

63KB
MD5

7aa2f47d3b960b717993b338705f442b
SHA1

12a7ab999312e41b83f67b6496376da18269df94
SHA256

157ed1654d7b6a6166a05e634c0df2785599086fda6e773ea7a723cfb3496668
SHA512

52f833b53a1e9d0e3079cc4bc484cbf3a2a0a9aa54b38150218d44434f0f7d91d67d8319486d607e8fc30688ebefb54b1498e95dab7b82e3bc95b6501be067b9
SSDEEP

768:oZ0xsb8grTI3XZY5hDOOpxMx6THDK1NpyVOYrkBvUQGOF8gfXMub0narzIfGZ+Di:oSxsYgwoDO1+2VmaXpNZ+23

Score

7^/10

upx vmprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3512-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3512-2-0x0000000000400000-0x000000000040C000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/3512-0-0x0000000000400000-0x000000000040C000-memory.dmp	vmprotect
behavioral2/memory/3512-2-0x0000000000400000-0x000000000040C000-memory.dmp	vmprotect

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎx	7aa2f47d3b960b717993b338705f442b.exe
File created	C:\Windows\SysWOW64\ÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎÎ	7aa2f47d3b960b717993b338705f442b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1412	3512	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3512	7aa2f47d3b960b717993b338705f442b.exe
3512	7aa2f47d3b960b717993b338705f442b.exe

C:\Users\Admin\AppData\Local\Temp\7aa2f47d3b960b717993b338705f442b.exe
"C:\Users\Admin\AppData\Local\Temp\7aa2f47d3b960b717993b338705f442b.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 700
  2⤵
  - Program crash
  PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3512 -ip 3512
1⤵
PID:5008

memory/3512-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3512-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download