767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 20:39

Target

767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57.exe
Size

653KB
MD5

db238646df10cec0ca9cb3dd336c09ef
SHA1

dd89a673759b75cd856420b82fc9c32fa4577b55
SHA256

767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57
SHA512

2474545d88363f9510471034b500188c1060a72572e37d97e40c62ebc57fcb0555d28360ad92be6116e3a326cb68d95718ac530e4a3c4bc569dd0fa7b92d5859
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+h:j7vmp8Rz1GJR8AB+Is9yvr7/jkg

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3036-1-0x000000013F230000-0x000000013F652000-memory.dmp	upx
behavioral1/memory/3036-2-0x000000013F230000-0x000000013F652000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1984	3036	767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57.exe	29
PID 3036 wrote to memory of 1984	3036	767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57.exe	29
PID 3036 wrote to memory of 1984	3036	767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57.exe	29

C:\Users\Admin\AppData\Local\Temp\767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57.exe
"C:\Users\Admin\AppData\Local\Temp\767acca108a90747857065beee6135a1d6baf4c8db6f61cd63e354ee15ec9c57.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3036 -s 84
  2⤵
  PID:1984

memory/3036-0-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download
memory/3036-1-0x000000013F230000-0x000000013F652000-memory.dmp

Filesize
4.1MB

Download
memory/3036-2-0x000000013F230000-0x000000013F652000-memory.dmp

Filesize
4.1MB

Download