e6efa6fe54712b3f777702380518e84997e7d6643a457e90b91469c792481d1e | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 05:11

Sharing

Report Analysis Logs

General

Target

b6971563234d0bbb58244118d01b3198.exe
Size

236KB
MD5

b6971563234d0bbb58244118d01b3198
SHA1

f73a23e272af56a5de1ba37073b651cccecd88d0
SHA256

e6efa6fe54712b3f777702380518e84997e7d6643a457e90b91469c792481d1e
SHA512

4d1c8c1aa8581e54c17bf768d74a88edac4394b1b9e3132e22fd8da310304661fd05477d79a40bc546563bb9789db9728dc1cd77e3e141b967232938b06eb2cd
SSDEEP

1536:6Zp71sAYLgMJfU0sEtl0q/qTiXLd8ycWDZnz0:6ZpmxgMxTqT8Lxx0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2928-0-0x0000000000400000-0x000000000048E000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2112	2928	b6971563234d0bbb58244118d01b3198.exe	28
PID 2928 wrote to memory of 2112	2928	b6971563234d0bbb58244118d01b3198.exe	28
PID 2928 wrote to memory of 2112	2928	b6971563234d0bbb58244118d01b3198.exe	28
PID 2928 wrote to memory of 2112	2928	b6971563234d0bbb58244118d01b3198.exe	28

C:\Users\Admin\AppData\Local\Temp\b6971563234d0bbb58244118d01b3198.exe
"C:\Users\Admin\AppData\Local\Temp\b6971563234d0bbb58244118d01b3198.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 36
  2⤵
  - Program crash
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-0-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download