6be15dfb99d607017067fedcacf51cb79462efa4b01b9417365d3a22252cd895 | Triage

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 04:06

Sharing

Report Analysis Logs

General

Target

bd9ea245702f5b7b7676a9806d4167d9.exe
Size

177KB
MD5

bd9ea245702f5b7b7676a9806d4167d9
SHA1

a64c43c702adae5bc2d400f7d322ab66504dd399
SHA256

6be15dfb99d607017067fedcacf51cb79462efa4b01b9417365d3a22252cd895
SHA512

728b98b4ab82e3f2942c399d4146e3be79a874ef384a5d74a37eeaf5720487391164d2669a8d5307da6aa9125e802b56aec059980d6e8ad24f1630181d0920ac
SSDEEP

3072:R29xzP53PWwnzelxEA8rkSDADeak7dJHB/Az7dE:wF/RerEA84SsQLH5AVE

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2776-0-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	2776	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2344	2776	bd9ea245702f5b7b7676a9806d4167d9.exe	28
PID 2776 wrote to memory of 2344	2776	bd9ea245702f5b7b7676a9806d4167d9.exe	28
PID 2776 wrote to memory of 2344	2776	bd9ea245702f5b7b7676a9806d4167d9.exe	28
PID 2776 wrote to memory of 2344	2776	bd9ea245702f5b7b7676a9806d4167d9.exe	28

C:\Users\Admin\AppData\Local\Temp\bd9ea245702f5b7b7676a9806d4167d9.exe
"C:\Users\Admin\AppData\Local\Temp\bd9ea245702f5b7b7676a9806d4167d9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 36
  2⤵
  - Program crash
  PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2776-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download