b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 02:38

Target

b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f.exe
Size

812KB
MD5

5a97f5e907d0d08e660191e5b340ea4a
SHA1

4ff5d824392c7b3fd7b2d13d657cb20020934532
SHA256

b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f
SHA512

eca2a2d33c9b12cbce1e082fdb553b6279e1fb2abc1e4aad1b5cb0f7cc0f021638a7241b00aef0189c730d7fdbed3778761bdaf833f7d377f71709acd0088f5a
SSDEEP

6144:W9/XXL5hWSEfh8uveT25mbkYjF/mbkYjFJRHpV3x:W9/XXL5xs62QwYjFuwYjFJ/Vh

Score

9^/10

Detects executables packed with Babel 2 IoCs

resource	yara_rule
behavioral1/memory/1252-0-0x0000000000BF0000-0x0000000000C92000-memory.dmp	INDICATOR_EXE_Packed_Babel
behavioral1/memory/1252-2-0x000000001AD60000-0x000000001ADE0000-memory.dmp	INDICATOR_EXE_Packed_Babel

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2212	1252	b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f.exe	28
PID 1252 wrote to memory of 2212	1252	b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f.exe	28
PID 1252 wrote to memory of 2212	1252	b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f.exe	28

C:\Users\Admin\AppData\Local\Temp\b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f.exe
"C:\Users\Admin\AppData\Local\Temp\b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1252 -s 608
  2⤵
  PID:2212

memory/1252-0-0x0000000000BF0000-0x0000000000C92000-memory.dmp

Filesize
648KB

Download
memory/1252-1-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/1252-2-0x000000001AD60000-0x000000001ADE0000-memory.dmp

Filesize
512KB

Download
memory/1252-3-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download