058bb3c22a9c7a7d37872ff36835b4df64755b4fa3981aab41b63f5388752a24 | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 02:25

Sharing

Report Analysis Logs

General

Target

8dfc110b3608a2f4822401f35b9094ee.exe
Size

24KB
MD5

8dfc110b3608a2f4822401f35b9094ee
SHA1

fae872a0c727292dcfa3a53d9fda80221bdcabb4
SHA256

058bb3c22a9c7a7d37872ff36835b4df64755b4fa3981aab41b63f5388752a24
SHA512

06ee2cbf78ad54252e2741a38f2a753db4982fbe21b0d35434e798cedaa7ab7e89ad838e44b8dbb32486dbec29326fa6c96198eee14be463e4d4c936020a0abd
SSDEEP

768:KwwrA1sq3WkmdxCL8OLUU+GQryK30QnNFr9:AMJ3mi8O2G1Kk+r9

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2180-0-0x0000000013140000-0x000000001315423B-memory.dmp	upx
behavioral1/memory/2180-1-0x0000000013140000-0x000000001315423B-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	2180	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1620	2180	8dfc110b3608a2f4822401f35b9094ee.exe	17
PID 2180 wrote to memory of 1620	2180	8dfc110b3608a2f4822401f35b9094ee.exe	17
PID 2180 wrote to memory of 1620	2180	8dfc110b3608a2f4822401f35b9094ee.exe	17
PID 2180 wrote to memory of 1620	2180	8dfc110b3608a2f4822401f35b9094ee.exe	17

C:\Users\Admin\AppData\Local\Temp\8dfc110b3608a2f4822401f35b9094ee.exe
"C:\Users\Admin\AppData\Local\Temp\8dfc110b3608a2f4822401f35b9094ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 160
  2⤵
  - Program crash
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-0-0x0000000013140000-0x000000001315423B-memory.dmp

Filesize
80KB

Download
memory/2180-1-0x0000000013140000-0x000000001315423B-memory.dmp

Filesize
80KB

Download