Overview

overview

7

Static

static

7

bc08abfbbb...f9.exe

windows7-x64

7

bc08abfbbb...f9.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-03-2024 14:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc08abfbbb802cee8cd32a09af311bf9.exe

  • Size

    38KB

  • MD5

    bc08abfbbb802cee8cd32a09af311bf9

  • SHA1

    e4343dbbb344eedc7cf2adb7bde761964ef79432

  • SHA256

    4aebdd20710d64ddc66d076460f30d461b8f045165e53755aa90b61e8d2e1e4a

  • SHA512

    2a4a29f3060b2735633af12018dc6dc3061a5994aa4a47cb08ee4d15fb8d17c0f790fd11cb1c3582993328a90b4a58143c867ccc3c765b534887d183b345e890

  • SSDEEP

    768:GEOxLcML79TLE5WZNUSgFEvMgDkq4atGScN+egI4tXTsEkM:axcknnZNegDhyScN+7Xto

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc08abfbbb802cee8cd32a09af311bf9.exe
    "C:\Users\Admin\AppData\Local\Temp\bc08abfbbb802cee8cd32a09af311bf9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\bc08abfbbb802cee8cd32a09af311bf9.exe
      "C:\Users\Admin\AppData\Local\Temp\bc08abfbbb802cee8cd32a09af311bf9.exe"
      2⤵
        PID:3288
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 80
          3⤵
          • Program crash
          PID:4912
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3288 -ip 3288
      1⤵
        PID:2820

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4108-0-0x0000000000200000-0x000000000031B000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/4108-2-0x0000000000200000-0x000000000031B000-memory.dmp

        Filesize

        1.1MB

        Download