786744a2886956991f106feee05ab8711c9ad4e53c5fe899f818652236fbc67a

Analysis

max time kernel
141s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 02:16

Target

8df82ffb595eea2c01f804eaf5b39c13.exe
Size

56KB
MD5

8df82ffb595eea2c01f804eaf5b39c13
SHA1

ccc202d7e17e1c96659c4b393b2a9d47a385f6a6
SHA256

786744a2886956991f106feee05ab8711c9ad4e53c5fe899f818652236fbc67a
SHA512

ae5050bd928405046acdc6260184b80dcf580211d35af8501763cb764c3a32726e7e14ab0aee108ba788a13ac0abdab37f6ba455d875ae52154d22fbf68b8c3f
SSDEEP

1536:Vh5BDGOJCfhWuyiDwJ11IphD4+ljWL/YrYZtbsFdXcXjK:nVJahlDwChcLPWMz

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2896-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2896-4-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2896 set thread context of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29

Program crash 1 IoCs

pid	pid_target	Process
2536	2308	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	8df82ffb595eea2c01f804eaf5b39c13.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2896 wrote to memory of 2308	2896	8df82ffb595eea2c01f804eaf5b39c13.exe	29
PID 2308 wrote to memory of 2536	2308	8df82ffb595eea2c01f804eaf5b39c13.exe	28
PID 2308 wrote to memory of 2536	2308	8df82ffb595eea2c01f804eaf5b39c13.exe	28
PID 2308 wrote to memory of 2536	2308	8df82ffb595eea2c01f804eaf5b39c13.exe	28
PID 2308 wrote to memory of 2536	2308	8df82ffb595eea2c01f804eaf5b39c13.exe	28

C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe
"C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe
  C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 92
1⤵
- Program crash
PID:2536

memory/2308-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2308-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2308-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2308-8-0x0000000000400000-0x000000000040EB56-memory.dmp

Filesize
58KB

Download
memory/2896-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2896-4-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download