37dc8a6ed7f40ab4ec9462f2008fe475721cd7e65a7b5194aee24c8cbe5e50cb

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 22:13

Target

8d7baeb8f71e3be2e96dfeec9ad71e0c.exe
Size

18KB
MD5

8d7baeb8f71e3be2e96dfeec9ad71e0c
SHA1

ce7fa221c0659321b82c9db905cc26b7ac81b5e3
SHA256

37dc8a6ed7f40ab4ec9462f2008fe475721cd7e65a7b5194aee24c8cbe5e50cb
SHA512

1310d0ead6dccf141193590992b7b926b3faf5a3a65c3a9c6f991525815ef32c6606d7b21b084a09e4bf5ec1cee5f7ead5e441292e388f38d422af2dcd632141
SSDEEP

384:wU7hP97BgFZwoaBhxwsloiCfkaMRtJr1H2JWW4vaIxNhY:wUP7BzhDRlnoktH8WW4vaIxNh

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2216-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2216	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1992	2216	8d7baeb8f71e3be2e96dfeec9ad71e0c.exe	28
PID 2216 wrote to memory of 1992	2216	8d7baeb8f71e3be2e96dfeec9ad71e0c.exe	28
PID 2216 wrote to memory of 1992	2216	8d7baeb8f71e3be2e96dfeec9ad71e0c.exe	28
PID 2216 wrote to memory of 1992	2216	8d7baeb8f71e3be2e96dfeec9ad71e0c.exe	28

C:\Users\Admin\AppData\Local\Temp\8d7baeb8f71e3be2e96dfeec9ad71e0c.exe
"C:\Users\Admin\AppData\Local\Temp\8d7baeb8f71e3be2e96dfeec9ad71e0c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 68
  2⤵
  - Program crash
  PID:1992

memory/2216-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download