23e94b30f05924c29fc1a06ee9efe4b866684760fb3e58db23e5e0d744197e64

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 19:25

Target

7dccfddeeb6dc22c6160eec68c85f1e6.exe
Size

338KB
MD5

7dccfddeeb6dc22c6160eec68c85f1e6
SHA1

b717767987ec884990f009cb0e2a336444339ce3
SHA256

23e94b30f05924c29fc1a06ee9efe4b866684760fb3e58db23e5e0d744197e64
SHA512

3da499ba242d58d43530545e75e662ad984db42f0b0b69ad9c0ab7cce2ecf517b7df953c2e58d7b4a5873d7e0ace021bcd0768e5520c7ff76a28e3d3984090f6
SSDEEP

6144:/mwX70wXvKO5fgYONYKAidSONMjvJG/nZ6LKx0OA6BThZ4wY:/mO4wf7fgYOWiwOq0PZ6IbrGwY

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3500-1-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1484	3500	WerFault.exe	83
4772	3500	WerFault.exe	83

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1144	3500	7dccfddeeb6dc22c6160eec68c85f1e6.exe	84
PID 3500 wrote to memory of 1144	3500	7dccfddeeb6dc22c6160eec68c85f1e6.exe	84

C:\Users\Admin\AppData\Local\Temp\7dccfddeeb6dc22c6160eec68c85f1e6.exe
"C:\Users\Admin\AppData\Local\Temp\7dccfddeeb6dc22c6160eec68c85f1e6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 572
  2⤵
  - Program crash
  PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 580
  2⤵
  - Program crash
  PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3500 -ip 3500
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3500 -ip 3500
1⤵
PID:1044

memory/3500-0-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3500-1-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download