9d7d86f4acd808e65a749bc0ddc76246a8ae66ff2cc380430bb36dc3a6efdf9b

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 02:32

Target

9841a7fce9f90cb0bbdbefbb7033bc25.exe
Size

840KB
MD5

9841a7fce9f90cb0bbdbefbb7033bc25
SHA1

91386adecf08037670b94a41eceebfe2d2134ee9
SHA256

9d7d86f4acd808e65a749bc0ddc76246a8ae66ff2cc380430bb36dc3a6efdf9b
SHA512

61a3080585cae93ae592d1ab082bb7ed2350de3ac4a726f854b42d0243ccf9c1498592a57d9495fd4c62519a72e8f73d56b258f87f1ada800ebcb59d8401db8b
SSDEEP

24576:NQMJx4YqqEAMjDbYp2rJTr8muA/vmt3I84ZASPzB:NQjbqdsDbJrJTr8u/vmnoASt

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2448-0-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral1/memory/2448-1-0x0000000000400000-0x00000000004E2000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2448	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2996	2448	9841a7fce9f90cb0bbdbefbb7033bc25.exe	28
PID 2448 wrote to memory of 2996	2448	9841a7fce9f90cb0bbdbefbb7033bc25.exe	28
PID 2448 wrote to memory of 2996	2448	9841a7fce9f90cb0bbdbefbb7033bc25.exe	28
PID 2448 wrote to memory of 2996	2448	9841a7fce9f90cb0bbdbefbb7033bc25.exe	28

C:\Users\Admin\AppData\Local\Temp\9841a7fce9f90cb0bbdbefbb7033bc25.exe
"C:\Users\Admin\AppData\Local\Temp\9841a7fce9f90cb0bbdbefbb7033bc25.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 152
  2⤵
  - Program crash
  PID:2996

memory/2448-0-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/2448-1-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download