933665dd43dce44d729f803bce66f08c1ee50b3e799f0f631b966db167f322e9

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 20:13

Target

e23f1433d40249e1550ff5429b162a58.exe
Size

16KB
MD5

e23f1433d40249e1550ff5429b162a58
SHA1

a36aefe53f317af9a69e0dbced9af0d7efff9037
SHA256

933665dd43dce44d729f803bce66f08c1ee50b3e799f0f631b966db167f322e9
SHA512

3deafbc24ecb096a94989d185a4243d8d3d3b0de23cec24beb635be02d4e02d076ba90f5d730d3999df7d8e49d5abc09cf9b0083c0cc302acdd9d9a5a58ad8bf
SSDEEP

192:ROzc+juAHKqKKSJqu7CtShLZUwlfGxsIwJPc5elrOqoknqLmgl3j0/43rnW4eWTW:OjuEKvlx7CtU6+eOb9VliuqnrnW4eaAX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1636-0-0x0000000000400000-0x000000000040D695-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	1636	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2220	1636	e23f1433d40249e1550ff5429b162a58.exe	28
PID 1636 wrote to memory of 2220	1636	e23f1433d40249e1550ff5429b162a58.exe	28
PID 1636 wrote to memory of 2220	1636	e23f1433d40249e1550ff5429b162a58.exe	28
PID 1636 wrote to memory of 2220	1636	e23f1433d40249e1550ff5429b162a58.exe	28

C:\Users\Admin\AppData\Local\Temp\e23f1433d40249e1550ff5429b162a58.exe
"C:\Users\Admin\AppData\Local\Temp\e23f1433d40249e1550ff5429b162a58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 92
  2⤵
  - Program crash
  PID:2220

memory/1636-0-0x0000000000400000-0x000000000040D695-memory.dmp

Filesize
53KB

Download