26ec89cc98a1497635564015f814777181f3b8f32b1898f882cc212ddbc3e3e0

Analysis

max time kernel
130s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:14

Target

26ec89cc98a1497635564015f814777181f3b8f32b1898f882cc212ddbc3e3e0.exe
Size

178KB
MD5

71475ab74dca9df80391aed15f0e3f03
SHA1

9039dd39109e1ca58c5a9a500262d150f99cc276
SHA256

26ec89cc98a1497635564015f814777181f3b8f32b1898f882cc212ddbc3e3e0
SHA512

4ff10f848f5e2de5d8f14b8442e93ec8e9a313a8f786eef3eaf62cf8051e60c323f77af46ca799ac9540a8faba6497956feb547cc551999bb9b9a0844070be2b
SSDEEP

3072:hNzztfivMVMYuFkV3qBnFqOLp4mvy2ACh3cj5z8UeWIV7aYfgqK6v9:hVz8YurEmvy2AChqzyWUK6

Score

9^/10

upx

UPX dump on OEP (original entry point) 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4904-0-0x0000000000400000-0x000000000042F000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4904-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4472 4904 WerFault.exe 26ec89cc98a1497635564015f814777181f3b8f32b1898f882cc212ddbc3e3e0.exe

pid	pid_target	process	target process
4472	4904	WerFault.exe	26ec89cc98a1497635564015f814777181f3b8f32b1898f882cc212ddbc3e3e0.exe

C:\Users\Admin\AppData\Local\Temp\26ec89cc98a1497635564015f814777181f3b8f32b1898f882cc212ddbc3e3e0.exe
"C:\Users\Admin\AppData\Local\Temp\26ec89cc98a1497635564015f814777181f3b8f32b1898f882cc212ddbc3e3e0.exe"
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 228
2⤵
- Program crash
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4904 -ip 4904
1⤵
PID:2992

memory/4904-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download