92e5a2fb9c2403bcdfffc5d91c7cc959da76e0ddd843b2d43a8a3a858f9c90a6

Analysis

max time kernel
19s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:53

Target

8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe
Size

124KB
MD5

602fa1f399796b7de5a1c8a6fb8b6b66
SHA1

4aece2d7564579f5927d5bb728d2367d5e4288c3
SHA256

8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754
SHA512

af3930df70e56024cd304b76c9f2a27d1c24d3033504fbfe812476fa0585e84912919c3b9ad9540f13ea2cdeaed150ea4dff205587ec79ed85e902d8d0f4128c
SSDEEP

3072:1y5+cyL8M/crrTRCbXdPI7YqZivjlR4Zby:1NgM/MrGdgO

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral30/memory/2132-0-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral30/memory/2132-2-0x0000000000400000-0x0000000000437000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 2132 WerFault.exe 8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe

pid	pid_target	process	target process
2160	2132	WerFault.exe	8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe

description	pid	process	target process
PID 2132 wrote to memory of 2160	2132	8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe	WerFault.exe
PID 2132 wrote to memory of 2160	2132	8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe	WerFault.exe
PID 2132 wrote to memory of 2160	2132	8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe	WerFault.exe
PID 2132 wrote to memory of 2160	2132	8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe
"C:\Users\Admin\AppData\Local\Temp\8d11fa106742bd9038bf92ed3b3912b51f9b768ebd85b380081f61940fd92754.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 208
2⤵
- Program crash
PID:2160

memory/2132-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2132-1-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/2132-2-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download