ea0bc0e479335703d0a93f1c4e5225211cb3e4e67e6f5d7e5f4d76593f2500aa | Triage

Analysis

max time kernel
140s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 17:25

Sharing

Report Analysis Logs

General

Target

8a1a45009a0d922e7bc66a9fe51e0abe.exe
Size

26KB
MD5

8a1a45009a0d922e7bc66a9fe51e0abe
SHA1

5a61305db68c9d543e490e9aedf3f3c9984701f9
SHA256

ea0bc0e479335703d0a93f1c4e5225211cb3e4e67e6f5d7e5f4d76593f2500aa
SHA512

0261054b78a0380e171b13df7d00b13850aef25ad0ffc2658c65440f590bf5e8a95fb4fca419d074744dc0f2e1c215ea0964fe26eb8f0ad7fe2a337d53f726f9
SSDEEP

768:5AWyLwqHq43GfWaTc/5pwSPtqhJQ7tlylX:d7qK43VH4SPAh0yl

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2900-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2900	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2956	2900	8a1a45009a0d922e7bc66a9fe51e0abe.exe	6
PID 2900 wrote to memory of 2956	2900	8a1a45009a0d922e7bc66a9fe51e0abe.exe	6
PID 2900 wrote to memory of 2956	2900	8a1a45009a0d922e7bc66a9fe51e0abe.exe	6
PID 2900 wrote to memory of 2956	2900	8a1a45009a0d922e7bc66a9fe51e0abe.exe	6

C:\Users\Admin\AppData\Local\Temp\8a1a45009a0d922e7bc66a9fe51e0abe.exe
"C:\Users\Admin\AppData\Local\Temp\8a1a45009a0d922e7bc66a9fe51e0abe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 160
  2⤵
  - Program crash
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download