3a28272cad3e6d0e0f3b4976d1acec032da49842c594148204dc29e18cec078c

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 18:57

Target

b96e2e6b7c61e4b6c15eb8b5ffc3160f.exe
Size

133KB
MD5

b96e2e6b7c61e4b6c15eb8b5ffc3160f
SHA1

188741f83df4c21ebdc3a99c499237f33fdc4a6e
SHA256

3a28272cad3e6d0e0f3b4976d1acec032da49842c594148204dc29e18cec078c
SHA512

2fbc9b5bf424cb6fb41c01dbc7cd8a40926d0c5ee9cc372330f2f8b72c110858ce1cd547268cf22729c6e87c131dc3276af27de548e242751a96ba6a9db9a728
SSDEEP

1536:maMmKEB9SeVOkNV9qpAUY539HpWwmgNkww5lx5lvLvEWgDAgvWSrj:I29xzP53PWwnzelxEA8rj

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2656-0-0x0000000000400000-0x0000000000460000-memory.dmp	upx
behavioral1/memory/2656-1-0x0000000000400000-0x0000000000460000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2656	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2752	2656	b96e2e6b7c61e4b6c15eb8b5ffc3160f.exe	28
PID 2656 wrote to memory of 2752	2656	b96e2e6b7c61e4b6c15eb8b5ffc3160f.exe	28
PID 2656 wrote to memory of 2752	2656	b96e2e6b7c61e4b6c15eb8b5ffc3160f.exe	28
PID 2656 wrote to memory of 2752	2656	b96e2e6b7c61e4b6c15eb8b5ffc3160f.exe	28

C:\Users\Admin\AppData\Local\Temp\b96e2e6b7c61e4b6c15eb8b5ffc3160f.exe
"C:\Users\Admin\AppData\Local\Temp\b96e2e6b7c61e4b6c15eb8b5ffc3160f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 36
  2⤵
  - Program crash
  PID:2752

memory/2656-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2656-1-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download