4e217367db5b496fea039f4f563c86c42aa422c15e082d4f08fb04df703c464b

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 05:57

Target

c526ce156d6479aaaa82119d275436a2.exe
Size

48KB
MD5

c526ce156d6479aaaa82119d275436a2
SHA1

f41e0936831176d2bb4062b7df728d758dcac22a
SHA256

4e217367db5b496fea039f4f563c86c42aa422c15e082d4f08fb04df703c464b
SHA512

37fd1f71269444a768d12468f806800000811dd1fc630c1fb35f44f6e91a758516225d40a0add4b8e0157b3bf953820eddc9f5add80c25172b34aa322effea19
SSDEEP

768:nY3lxtYouQ6KRrf89WOX4E0XY7WIsWSyf+2QeHlXLSAmCbUzlqp9z:nY3+1Q6ar6WO/eRyfkewMgqp9z

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2664-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/2664-1-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2664	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3032	2664	c526ce156d6479aaaa82119d275436a2.exe	28
PID 2664 wrote to memory of 3032	2664	c526ce156d6479aaaa82119d275436a2.exe	28
PID 2664 wrote to memory of 3032	2664	c526ce156d6479aaaa82119d275436a2.exe	28
PID 2664 wrote to memory of 3032	2664	c526ce156d6479aaaa82119d275436a2.exe	28

C:\Users\Admin\AppData\Local\Temp\c526ce156d6479aaaa82119d275436a2.exe
"C:\Users\Admin\AppData\Local\Temp\c526ce156d6479aaaa82119d275436a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 148
  2⤵
  - Program crash
  PID:3032

memory/2664-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2664-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download