e79ef3365eab958c1503bfb7746bef4c98faab5070cb31596d505459945c1351 | Triage

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 23:41

Sharing

Report Analysis Logs

General

Target

7e4f319e6c12441050390f10074fe01a.exe
Size

14KB
MD5

7e4f319e6c12441050390f10074fe01a
SHA1

18b46202a167bbdab7c75950abe3f5477df3f123
SHA256

e79ef3365eab958c1503bfb7746bef4c98faab5070cb31596d505459945c1351
SHA512

1510870757ced88c05a2dceaee0df390b88a2fa80d0a4e8767f16915dfd9628f9efa51cf955f5fe6ed0519c4d30aed6cb9e86fdf9b40e3f65a796e41e1728f6c
SSDEEP

384:2o+glqeZFyYOw1TipBUAIj1q3ScB5gN1XX7XNz:n8eKglJvUSYgjXX7XV

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2288-0-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral1/memory/2288-1-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	2288	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2024	2288	7e4f319e6c12441050390f10074fe01a.exe	28
PID 2288 wrote to memory of 2024	2288	7e4f319e6c12441050390f10074fe01a.exe	28
PID 2288 wrote to memory of 2024	2288	7e4f319e6c12441050390f10074fe01a.exe	28
PID 2288 wrote to memory of 2024	2288	7e4f319e6c12441050390f10074fe01a.exe	28

C:\Users\Admin\AppData\Local\Temp\7e4f319e6c12441050390f10074fe01a.exe
"C:\Users\Admin\AppData\Local\Temp\7e4f319e6c12441050390f10074fe01a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 148
  2⤵
  - Program crash
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2288-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download