fe463c19134f8880988584a4cf17e44cfec3f4621c0292155af4c96db16f8413

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 16:11

Target

a4378d610ae9e8218e8948a99e4b7900.exe
Size

70KB
MD5

a4378d610ae9e8218e8948a99e4b7900
SHA1

abb040950aafc5dd86544dd20cc3aa1e32ba0bd2
SHA256

fe463c19134f8880988584a4cf17e44cfec3f4621c0292155af4c96db16f8413
SHA512

df84233848287df6399dc7c05f16ecf7c8148db0889466422db726796fc6c7b425e64e8b3709edd608a08b8363e33d0d1f710505cdcf93f3cdec95f598433c06
SSDEEP

768:7BxZkRQh2gWGstiSSWDfThpOhcpmiBPh5iE79gD0sgDmGc/kF4EJRQV6rEHfUf+T:7BxAJztiSZvUiBPfiE7qR+EAEHucOzI

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000400000-0x000000000043B000-memory.dmp	upx
behavioral1/memory/1992-1-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	1992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2300	1992	a4378d610ae9e8218e8948a99e4b7900.exe	28
PID 1992 wrote to memory of 2300	1992	a4378d610ae9e8218e8948a99e4b7900.exe	28
PID 1992 wrote to memory of 2300	1992	a4378d610ae9e8218e8948a99e4b7900.exe	28
PID 1992 wrote to memory of 2300	1992	a4378d610ae9e8218e8948a99e4b7900.exe	28

C:\Users\Admin\AppData\Local\Temp\a4378d610ae9e8218e8948a99e4b7900.exe
"C:\Users\Admin\AppData\Local\Temp\a4378d610ae9e8218e8948a99e4b7900.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 148
  2⤵
  - Program crash
  PID:2300

memory/1992-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1992-1-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download