0229f9d9599fa8479612c47c51ebe67a6365e91d29dd634d486392a90b8087f0

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 22:01

Target

VirusShare-000acc09e40cd9c4913b8387a1f27a03.exe
Size

198KB
MD5

000acc09e40cd9c4913b8387a1f27a03
SHA1

f34e3bebebe077afa6b7ef31508a0b8a02816cd5
SHA256

0229f9d9599fa8479612c47c51ebe67a6365e91d29dd634d486392a90b8087f0
SHA512

7a59f2daa0b8258f0782d4ac3e261098b04ebabcf09637d6c4b7ee0927a67d7a6fb52482477a5994b07f0e8761ede472b33918a1cc1223c3130a9b8622386bf8
SSDEEP

3072:ix8IJiZ5OGiqSGnIPoFcnOspvZ51FfjLRMbheK9aZ4dBNVitV9mguqGKhBFr5/Gz:ix7JiZYG7BnanpB1f+bAGHVxglFF0

Score

9^/10

upx

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x0000000000451000-memory.dmp	UPX
behavioral1/memory/2888-1-0x0000000000400000-0x0000000000451000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/memory/2888-1-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	2888	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2892	2888	VirusShare-000acc09e40cd9c4913b8387a1f27a03.exe	11
PID 2888 wrote to memory of 2892	2888	VirusShare-000acc09e40cd9c4913b8387a1f27a03.exe	11
PID 2888 wrote to memory of 2892	2888	VirusShare-000acc09e40cd9c4913b8387a1f27a03.exe	11
PID 2888 wrote to memory of 2892	2888	VirusShare-000acc09e40cd9c4913b8387a1f27a03.exe	11

C:\Users\Admin\AppData\Local\Temp\VirusShare-000acc09e40cd9c4913b8387a1f27a03.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare-000acc09e40cd9c4913b8387a1f27a03.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 44
  2⤵
  - Program crash
  PID:2892

memory/2888-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2888-1-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download