dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 01:00

Target

dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740.exe
Size

653KB
MD5

98f9207aca224ec048788d1285c19cee
SHA1

8d94d1635f6362a7570f23b198a30c086f7448b8
SHA256

dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740
SHA512

fb332da2bcb8e8ea841713ce440ef0c4d28aefc47d15de81f5808be54c01850855501260b42e367e0eef6d1a4a13d27bf269bc2294de94a05ce441a2fbd144a3
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+I:j7vmp8Rz1GJR8AB+Is9yvr7/jk1

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1488-1-0x000000013F770000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/1488-2-0x000000013F770000-0x000000013FB92000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2964	1488	dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740.exe	29
PID 1488 wrote to memory of 2964	1488	dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740.exe	29
PID 1488 wrote to memory of 2964	1488	dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740.exe	29

C:\Users\Admin\AppData\Local\Temp\dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740.exe
"C:\Users\Admin\AppData\Local\Temp\dfdeeb6a1ec02bb1338f88d32201e70f6dfd87974cd5d422826a0f4f1df92740.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1488 -s 84
  2⤵
  PID:2964

memory/1488-0-0x00000000003F0000-0x0000000000410000-memory.dmp

Filesize
128KB

Download
memory/1488-1-0x000000013F770000-0x000000013FB92000-memory.dmp

Filesize
4.1MB

Download
memory/1488-2-0x000000013F770000-0x000000013FB92000-memory.dmp

Filesize
4.1MB

Download