b7dca6425e4686eb1bb19244baa2276e1396be621dabc3c52d8643c236b82ba0

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 08:29

Target

8669c51b008c2536f3562151cecff5bf.exe
Size

259KB
MD5

8669c51b008c2536f3562151cecff5bf
SHA1

790ea76c08d65c44e285b77995b81b9294c0bc56
SHA256

b7dca6425e4686eb1bb19244baa2276e1396be621dabc3c52d8643c236b82ba0
SHA512

d16659f84d4fedaff55f8d611c48d46867043edaeef708afa427e37070185c42fe6eaaa6e71579f45b1d6b11991412ace647dd599b3c79aa3603e62d491c6aae
SSDEEP

1536:7Ln+RnGm56gy2Xbpk7UY92NAph+vfNVlyQkBAy1OknLnB:7InGm5677UGTIfMhlnLnB

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1956-0-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/1956-1-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	1956	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2472	1956	8669c51b008c2536f3562151cecff5bf.exe	28
PID 1956 wrote to memory of 2472	1956	8669c51b008c2536f3562151cecff5bf.exe	28
PID 1956 wrote to memory of 2472	1956	8669c51b008c2536f3562151cecff5bf.exe	28
PID 1956 wrote to memory of 2472	1956	8669c51b008c2536f3562151cecff5bf.exe	28

C:\Users\Admin\AppData\Local\Temp\8669c51b008c2536f3562151cecff5bf.exe
"C:\Users\Admin\AppData\Local\Temp\8669c51b008c2536f3562151cecff5bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 92
  2⤵
  - Program crash
  PID:2472

memory/1956-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1956-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download