3b19bf967e5114debb21d2f43447c32b890249089b786e55d2d42605964e8a80

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 19:58

Target

b9860d767ceb80ae8a3519c88639f8f6.exe
Size

8KB
MD5

b9860d767ceb80ae8a3519c88639f8f6
SHA1

dc727f2ff3e437d7ced9bd5bd25086bc6ba1f6cd
SHA256

3b19bf967e5114debb21d2f43447c32b890249089b786e55d2d42605964e8a80
SHA512

8f977f9c870e02642b747d3772a308711eaf3f50d647eee7feca8e250e572fc0f1e4a8884d9ca933ab04c830225b16258f3c7531b3a3abd31f9c27727504e002
SSDEEP

96:Z1f3CAxeb3B6CukOmoCXqNVJJLcsWRvO4ng5LsU2oZ9lONIjZ9:OAxebYCuZE4L/sRn0C4

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3016-2-0x0000000000400000-0x0000000000403000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	3016	WerFault.exe	27

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3016	b9860d767ceb80ae8a3519c88639f8f6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2344	3016	b9860d767ceb80ae8a3519c88639f8f6.exe	28
PID 3016 wrote to memory of 2344	3016	b9860d767ceb80ae8a3519c88639f8f6.exe	28
PID 3016 wrote to memory of 2344	3016	b9860d767ceb80ae8a3519c88639f8f6.exe	28
PID 3016 wrote to memory of 2344	3016	b9860d767ceb80ae8a3519c88639f8f6.exe	28

C:\Users\Admin\AppData\Local\Temp\b9860d767ceb80ae8a3519c88639f8f6.exe
"C:\Users\Admin\AppData\Local\Temp\b9860d767ceb80ae8a3519c88639f8f6.exe"
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 36
  2⤵
  - Program crash
  PID:2344

memory/3016-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3016-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3016-2-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download