786744a2886956991f106feee05ab8711c9ad4e53c5fe899f818652236fbc67a

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 02:16

Target

8df82ffb595eea2c01f804eaf5b39c13.exe
Size

56KB
MD5

8df82ffb595eea2c01f804eaf5b39c13
SHA1

ccc202d7e17e1c96659c4b393b2a9d47a385f6a6
SHA256

786744a2886956991f106feee05ab8711c9ad4e53c5fe899f818652236fbc67a
SHA512

ae5050bd928405046acdc6260184b80dcf580211d35af8501763cb764c3a32726e7e14ab0aee108ba788a13ac0abdab37f6ba455d875ae52154d22fbf68b8c3f
SSDEEP

1536:Vh5BDGOJCfhWuyiDwJ11IphD4+ljWL/YrYZtbsFdXcXjK:nVJahlDwChcLPWMz

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2884-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/2884-6-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52

Program crash 1 IoCs

pid	pid_target	Process
3736	4504	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2884	8df82ffb595eea2c01f804eaf5b39c13.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52
PID 2884 wrote to memory of 4504	2884	8df82ffb595eea2c01f804eaf5b39c13.exe	52

C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe
"C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe
  C:\Users\Admin\AppData\Local\Temp\8df82ffb595eea2c01f804eaf5b39c13.exe
  2⤵
  PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4504 -ip 4504
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 236
1⤵
- Program crash
PID:3736

memory/2884-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2884-6-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4504-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4504-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4504-3-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4504-9-0x0000000000400000-0x000000000040EB56-memory.dmp

Filesize
58KB

Download