2a673e1f739ff7316969eb20b060a99574f51b97822eace865b2d30ee3a69100

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 01:53

Target

ad64732c169f16d8062811416406884a.exe
Size

694KB
MD5

ad64732c169f16d8062811416406884a
SHA1

5609adc0e9d928073bd289e6027a715932cef131
SHA256

2a673e1f739ff7316969eb20b060a99574f51b97822eace865b2d30ee3a69100
SHA512

4084d998452fbb63def32f1c1c08e2b63c610d03a50a699cd4f5958797574a8d40893faa60dc9765ba321d95598e586f807ec9e025eac639cd3cf2d04b33bbb8
SSDEEP

12288:QtmvS1q2iDoXMVS0LBRIHt9lUWiFyll4eLQ7ZqVfRfa:Qtb82iMXITWzCq87MVfRS

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1420-0-0x00000000008E0000-0x000000000098F000-memory.dmp	upx
behavioral1/memory/1420-1-0x00000000008E0000-0x000000000098F000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	1420	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2340	1420	ad64732c169f16d8062811416406884a.exe	28
PID 1420 wrote to memory of 2340	1420	ad64732c169f16d8062811416406884a.exe	28
PID 1420 wrote to memory of 2340	1420	ad64732c169f16d8062811416406884a.exe	28
PID 1420 wrote to memory of 2340	1420	ad64732c169f16d8062811416406884a.exe	28

C:\Users\Admin\AppData\Local\Temp\ad64732c169f16d8062811416406884a.exe
"C:\Users\Admin\AppData\Local\Temp\ad64732c169f16d8062811416406884a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 64
  2⤵
  - Program crash
  PID:2340

memory/1420-0-0x00000000008E0000-0x000000000098F000-memory.dmp

Filesize
700KB

Download
memory/1420-1-0x00000000008E0000-0x000000000098F000-memory.dmp

Filesize
700KB

Download