7c983e8fbdbbcc8f20fe8b6b45dd94d631676abc545023053576c72ff6d7c924 | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 09:16

Sharing

Report Analysis Logs

General

Target

c038a0eeb312da80f5fc409ff8c475e4.exe
Size

15KB
MD5

c038a0eeb312da80f5fc409ff8c475e4
SHA1

1dd00a5de1a7a0592b932bf9f0acd8f7a8ababd8
SHA256

7c983e8fbdbbcc8f20fe8b6b45dd94d631676abc545023053576c72ff6d7c924
SHA512

240361950d49c4343580b4f06ee974386fc95e2bf208de7877b9f517ae640ac45c950fe2eff55266b2aac953e87e03ebb2aa64068321365d1a1d72822f699f3d
SSDEEP

384:A2iDbQ6PCPgI/y6Z7FoLEJdMcWlSD+WaexB1Q8r0j:AFv7I/y27Fow8U+WHB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1736-0-0x0000000001000000-0x000000000100C000-memory.dmp	upx
behavioral1/memory/1736-1-0x0000000001000000-0x000000000100C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	1736	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2608	1736	c038a0eeb312da80f5fc409ff8c475e4.exe	28
PID 1736 wrote to memory of 2608	1736	c038a0eeb312da80f5fc409ff8c475e4.exe	28
PID 1736 wrote to memory of 2608	1736	c038a0eeb312da80f5fc409ff8c475e4.exe	28
PID 1736 wrote to memory of 2608	1736	c038a0eeb312da80f5fc409ff8c475e4.exe	28

C:\Users\Admin\AppData\Local\Temp\c038a0eeb312da80f5fc409ff8c475e4.exe
"C:\Users\Admin\AppData\Local\Temp\c038a0eeb312da80f5fc409ff8c475e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 120
  2⤵
  - Program crash
  PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-0-0x0000000001000000-0x000000000100C000-memory.dmp

Filesize
48KB

Download
memory/1736-1-0x0000000001000000-0x000000000100C000-memory.dmp

Filesize
48KB

Download