fa925b3e76ed9daa56d7dc81d622202a7aa2649f923f97a986d214bc1ccad048

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 22:39

Target
Cat.Goes.Fishing.v13.11.2019/Cat Goes Fishing.exe
Size 4.3MB
Sample240302-2lcnbsae44
SHA256 fab76ae5f809e690fe130857a266d822b772e91f829781a09c11b4c380b5889c
MD5 906f75296beed2234b5488f8199fc75b
SHA1 f9371f6f24a40594dcf4b96585a9f4033a70e59e
SHA512 4d156e3429ea1eb372ace4c4fd0e708b15afc99aac4c7b2b214ac74df31d8e055bdc644dac173a125f161a179c33d8f58ad33e633d101fb5fa894c6c08a8cc5f
SSDEEP 49152:S3wAodQ91UcVUFWPFVjI+bPb4fuJXsvgKbV0RnLMBTWdjeJw61:S/odyacVUKjOuJX3KSRnLM0djxa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2020-0-0x0000000072610000-0x0000000073448000-memory.dmp	upx
behavioral3/memory/2020-1-0x0000000072610000-0x0000000073448000-memory.dmp	upx
behavioral3/memory/2020-4-0x0000000072610000-0x0000000073448000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2976	2020	WerFault.exe	27

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2020	Cat Goes Fishing.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2976	2020	Cat Goes Fishing.exe	28
PID 2020 wrote to memory of 2976	2020	Cat Goes Fishing.exe	28
PID 2020 wrote to memory of 2976	2020	Cat Goes Fishing.exe	28
PID 2020 wrote to memory of 2976	2020	Cat Goes Fishing.exe	28

C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Cat Goes Fishing.exe
"C:\Users\Admin\AppData\Local\Temp\Cat.Goes.Fishing.v13.11.2019\Cat Goes Fishing.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 544
  2⤵
  - Program crash
  PID:2976

memory/2020-0-0x0000000072610000-0x0000000073448000-memory.dmp

Download

memory/2020-1-0x0000000072610000-0x0000000073448000-memory.dmp

Download

memory/2020-4-0x0000000072610000-0x0000000073448000-memory.dmp

Download