f205ee6e2b6a12944f9c195c18f678e87e1fc6a7fde750301e513867b3cc4d42 | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 17:59

Sharing

Report Analysis Logs

General

Target

c6859e3f72646d3cf2a4b846c4cea103.exe
Size

16KB
MD5

c6859e3f72646d3cf2a4b846c4cea103
SHA1

8fdd8e1f53cd86f1f01acaf2c7c94c76da5809c2
SHA256

f205ee6e2b6a12944f9c195c18f678e87e1fc6a7fde750301e513867b3cc4d42
SHA512

07aba7e1467843e79427231a24953719dc3253fc4c4db07f43a06ba91d7ee71767c32d55a5445bd0d4de94a0fa419034157f62ad0cb260c8461f317c68a767c9
SSDEEP

384:AVFjCsvBVX0zkpvCdASC7tJ/erX+hbxrnW4eai:8xBlp6KFt9u+ZxIV

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x000000000040D692-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	2220	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2044	2220	c6859e3f72646d3cf2a4b846c4cea103.exe	28
PID 2220 wrote to memory of 2044	2220	c6859e3f72646d3cf2a4b846c4cea103.exe	28
PID 2220 wrote to memory of 2044	2220	c6859e3f72646d3cf2a4b846c4cea103.exe	28
PID 2220 wrote to memory of 2044	2220	c6859e3f72646d3cf2a4b846c4cea103.exe	28

C:\Users\Admin\AppData\Local\Temp\c6859e3f72646d3cf2a4b846c4cea103.exe
"C:\Users\Admin\AppData\Local\Temp\c6859e3f72646d3cf2a4b846c4cea103.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 92
  2⤵
  - Program crash
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000000400000-0x000000000040D692-memory.dmp

Filesize
53KB

Download