e6bef6348cd547c9154f51341690bd53f7e09f21055f737f245741a102666f92

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 04:19

Target

8e3386e5f070f3d73a814c2f8e6555a2.exe
Size

928KB
MD5

8e3386e5f070f3d73a814c2f8e6555a2
SHA1

ed144aa868b5e94727c16c0470c0551543fce7cc
SHA256

e6bef6348cd547c9154f51341690bd53f7e09f21055f737f245741a102666f92
SHA512

9cb13b288b4cdc15b11060dc4cadfc79df4b8abf31a43f98be2be4367f7f450c7d95189a0b3b792725794a3c95f9d0903a1e39f08e2dca98d3d453b772c698f7
SSDEEP

24576:8IvOwS5ZkHF7KLEPzkdB5qcSWXttueceBonDgt0DgrWvV:CkHF2LEPzkbttvBaDgeDIWvV

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2372-3-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2372-2-0x0000000010000000-0x0000000010020000-memory.dmp	upx
behavioral1/memory/2372-0-0x0000000010000000-0x0000000010020000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	2372	WerFault.exe	1

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2212	2372	8e3386e5f070f3d73a814c2f8e6555a2.exe	20
PID 2372 wrote to memory of 2212	2372	8e3386e5f070f3d73a814c2f8e6555a2.exe	20
PID 2372 wrote to memory of 2212	2372	8e3386e5f070f3d73a814c2f8e6555a2.exe	20
PID 2372 wrote to memory of 2212	2372	8e3386e5f070f3d73a814c2f8e6555a2.exe	20

C:\Users\Admin\AppData\Local\Temp\8e3386e5f070f3d73a814c2f8e6555a2.exe
"C:\Users\Admin\AppData\Local\Temp\8e3386e5f070f3d73a814c2f8e6555a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 116
  2⤵
  - Program crash
  PID:2212

memory/2372-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2372-2-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2372-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download