05b7e5a604ab23901102ea249c2871abcf6313c2c8f3542258f25cce95c7c72a

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 08:45

Target

cafa210998bf27d7b88933d46f6d9741.exe
Size

139KB
MD5

cafa210998bf27d7b88933d46f6d9741
SHA1

9e42da738209b392a639a56fb34f324d6e2c1298
SHA256

05b7e5a604ab23901102ea249c2871abcf6313c2c8f3542258f25cce95c7c72a
SHA512

0e1993380cd54e2e4e7ed2648d6cb2fb37554c3f37e51d518ee8678ef292a92fb24035aa21c8df8eff369d45201303c2b2f8c60eae8ea024d158ffe3fd353271
SSDEEP

3072:MoQgZbAKIlhs285uIabuGtL1swSnM8WstI3VB2Jv4xoX:M62PH7nJbuGXsVM8WsqlmAx2

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2100-1-0x0000000000220000-0x00000000002A0000-memory.dmp	upx
behavioral1/memory/2100-2-0x0000000000220000-0x00000000002A0000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	2100	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1816	2100	cafa210998bf27d7b88933d46f6d9741.exe	28
PID 2100 wrote to memory of 1816	2100	cafa210998bf27d7b88933d46f6d9741.exe	28
PID 2100 wrote to memory of 1816	2100	cafa210998bf27d7b88933d46f6d9741.exe	28
PID 2100 wrote to memory of 1816	2100	cafa210998bf27d7b88933d46f6d9741.exe	28

C:\Users\Admin\AppData\Local\Temp\cafa210998bf27d7b88933d46f6d9741.exe
"C:\Users\Admin\AppData\Local\Temp\cafa210998bf27d7b88933d46f6d9741.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 124
  2⤵
  - Program crash
  PID:1816

memory/2100-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2100-1-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download
memory/2100-2-0x0000000000220000-0x00000000002A0000-memory.dmp

Filesize
512KB

Download
memory/2100-3-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download