e20c06976d9fb3138ccc01dcfd74f1ec60d38893910e022eed3a80c8ebeb2050 | Triage

Analysis

max time kernel
157s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 19:16

Sharing

Report Analysis Logs

General

Target

87aee6d7bee80d0b14b41ea878288044.exe
Size

290KB
MD5

87aee6d7bee80d0b14b41ea878288044
SHA1

8ccedbd56092a75e2799771c85888a6b9bc82483
SHA256

e20c06976d9fb3138ccc01dcfd74f1ec60d38893910e022eed3a80c8ebeb2050
SHA512

f410cc3739b7e1896fa7a88c0b7d06e5736eddae8cc6c0f034be2fea2ceabcdac63b8540c45c9b5d80024b5da76a91e7ec0aa395acb6e2cbea2cde5af0b7df1f
SSDEEP

6144:dTnjnvrM3mjHGh5Doh9Z5cAea4Jv81E64GB:dHn438Hwerea2vEE5k

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2076-0-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/2076-1-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2076	WerFault.exe	5

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2736	2076	87aee6d7bee80d0b14b41ea878288044.exe	27
PID 2076 wrote to memory of 2736	2076	87aee6d7bee80d0b14b41ea878288044.exe	27
PID 2076 wrote to memory of 2736	2076	87aee6d7bee80d0b14b41ea878288044.exe	27
PID 2076 wrote to memory of 2736	2076	87aee6d7bee80d0b14b41ea878288044.exe	27

C:\Users\Admin\AppData\Local\Temp\87aee6d7bee80d0b14b41ea878288044.exe
"C:\Users\Admin\AppData\Local\Temp\87aee6d7bee80d0b14b41ea878288044.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 204
  2⤵
  - Program crash
  PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2076-1-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download