9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0

Analysis

max time kernel
129s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:01

Target

9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe
Size

1.5MB
MD5

26cf725f4096976fb2729cc656f4ecf8
SHA1

b39ecdfcd98ee18b02f3950981cc079d4b573461
SHA256

9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0
SHA512

acc171f4049e0c19e3dbaa297c142b3e4a55fc8657bf42e5c2b0d146de04ea1a95c381b731b3c91774f2acef1cddb68fa4889592cec8a50796772a1d94058ef5
SSDEEP

6144:XElKgzelZNQSBQGH/CSpWqT7wNaSfBF58TQ8GYrmj:5fBQGH6SffwNaSf6cX

Score

9^/10

Detects executables built or packed with MPress PE compressor 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3444-0-0x0000000000400000-0x00000000004A9000-memory.dmp	INDICATOR_EXE_Packed_MPress

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3012 3444 WerFault.exe 9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe

pid	pid_target	process	target process
3012	3444	WerFault.exe	9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe

C:\Users\Admin\AppData\Local\Temp\9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe
"C:\Users\Admin\AppData\Local\Temp\9ba257db4a390f9ac2989c5e97606d58c89c9c04f63bf799bd76b783119b1ee0.exe"
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 216
2⤵
- Program crash
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3444 -ip 3444
1⤵
PID:1168

memory/3444-0-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download