045d57e7b713638af7b16079ad9c717d2ca9c57e94de24413f2f85ff9cc465c8

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 00:49

Target

HDTunePro+5.75+Portable.exe
Size

2.7MB
MD5

61915d0c1e6820b8b201b7b1df2ad072
SHA1

c86db858a2effcc05fad59a32406e77afb0d70e6
SHA256

045d57e7b713638af7b16079ad9c717d2ca9c57e94de24413f2f85ff9cc465c8
SHA512

2fe03f596cdbc00d56360af079292010836fb43ad006b8e76540d62c8b910844b5584c85b6538b602a89103c5572f83a10fd3eb43a0074cff7c89871e5e3c8ae
SSDEEP

49152:ZLPxta/q0/k7rON0nawGx2MO9ZnR8j4G+xUmA4CjKgY8xLVUo3fzi:rtmqPnDGxW9dR8jvTl4C1xRnfzi

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2056-0-0x0000000140000000-0x00000001400F6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2152	2056	HDTunePro+5.75+Portable.exe	28
PID 2056 wrote to memory of 2152	2056	HDTunePro+5.75+Portable.exe	28
PID 2056 wrote to memory of 2152	2056	HDTunePro+5.75+Portable.exe	28

C:\Users\Admin\AppData\Local\Temp\HDTunePro+5.75+Portable.exe
"C:\Users\Admin\AppData\Local\Temp\HDTunePro+5.75+Portable.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2056 -s 128
  2⤵
  PID:2152

memory/2056-0-0x0000000140000000-0x00000001400F6000-memory.dmp

Filesize
984KB

Download