1cc337fa0a89cc6d4754a8b176fc30d80b38f677504124445d78b200e64dc2d5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 20:01

Target

d4647a88825c1cda20e123c416a84e6f.exe
Size

6KB
MD5

d4647a88825c1cda20e123c416a84e6f
SHA1

5adefa83062c2e0c3b61f50236978de04992e6c5
SHA256

1cc337fa0a89cc6d4754a8b176fc30d80b38f677504124445d78b200e64dc2d5
SHA512

43e3800289e32316ee5a1c957ca7011ec442a527416250a9dc3901d3757f25084a707a045498f6d5dab1f04b865a811048142571aef4f35d441157f928c51a3e
SSDEEP

192:OxTj8oMn0c7O1CaGzN5FlY1xvG6xdPbhDJ2EJPvEGHk:3n0c7KfgNHlOk6xdPtD/MKk

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2892-0-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	2892	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2316	2892	d4647a88825c1cda20e123c416a84e6f.exe	28
PID 2892 wrote to memory of 2316	2892	d4647a88825c1cda20e123c416a84e6f.exe	28
PID 2892 wrote to memory of 2316	2892	d4647a88825c1cda20e123c416a84e6f.exe	28
PID 2892 wrote to memory of 2316	2892	d4647a88825c1cda20e123c416a84e6f.exe	28

C:\Users\Admin\AppData\Local\Temp\d4647a88825c1cda20e123c416a84e6f.exe
"C:\Users\Admin\AppData\Local\Temp\d4647a88825c1cda20e123c416a84e6f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 92
  2⤵
  - Program crash
  PID:2316

memory/2892-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download