f39ef6282b7b62d920dba9dd5591ab17f2cceb8fc423a3511ff3ae8ccf180fb5

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 10:30

Target

b73287d6ab035a47f83dfc000b483f49.exe
Size

134KB
MD5

b73287d6ab035a47f83dfc000b483f49
SHA1

82588a1b71af50fb65614f9fde6eddc0be72427a
SHA256

f39ef6282b7b62d920dba9dd5591ab17f2cceb8fc423a3511ff3ae8ccf180fb5
SHA512

7f2e808ff23a7c9efdc5cca7b36e93bde63f3a4d69477e34a4e93c2b6a75b17b8549aed3d24b21c549441ea5d353126aa6031a0fd98f91e04289aaf6aed8a090
SSDEEP

3072:X5bBGLEZ4pSA/WuYwfapCIGYxIeYadx9L24eUuLwBVO1CGovl:JbBBaWuYwfWCRYxW821P4vl

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2384-0-0x0000000013150000-0x0000000013193000-memory.dmp	upx
behavioral1/memory/2384-1-0x0000000013150000-0x0000000013193000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
356	2384	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 356	2384	b73287d6ab035a47f83dfc000b483f49.exe	28
PID 2384 wrote to memory of 356	2384	b73287d6ab035a47f83dfc000b483f49.exe	28
PID 2384 wrote to memory of 356	2384	b73287d6ab035a47f83dfc000b483f49.exe	28
PID 2384 wrote to memory of 356	2384	b73287d6ab035a47f83dfc000b483f49.exe	28

C:\Users\Admin\AppData\Local\Temp\b73287d6ab035a47f83dfc000b483f49.exe
"C:\Users\Admin\AppData\Local\Temp\b73287d6ab035a47f83dfc000b483f49.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 148
  2⤵
  - Program crash
  PID:356

memory/2384-0-0x0000000013150000-0x0000000013193000-memory.dmp

Filesize
268KB

Download
memory/2384-1-0x0000000013150000-0x0000000013193000-memory.dmp

Filesize
268KB

Download