322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 11:40

Target
322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4.exe
Size 1.9MB
Sample240607-nst93afe3z
SHA256 322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4
MD5 d467f4e3d950cffad657af67e9844f6b
SHA1 023324332ec3437e9eeaa512318c2b62dcf18296
SHA512 e79209661464aaeb0374e4d9694efd519aaf6a978e30d3e8318c45bc3ac47de57fa81230f56b85a14ddf9967f22a92d8267cc9ffb33f681d20c1f551181d8050
SSDEEP 24576:UvxlJ9d6IscEUIUH0JCYcQb4uTtyaXWnjovY+1N9f2+W4upMtMAHn8J+RgBbN89i:ULJ96cZH08mr0AWknUxmQlbN+cf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5064-0-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral2/memory/5064-37-0x0000000000400000-0x00000000007A7000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4852	5064	WerFault.exe	91

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5064	322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4.exe
5064	322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4.exe
5064	322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4.exe
5064	322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4.exe

C:\Users\Admin\AppData\Local\Temp\322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4.exe
"C:\Users\Admin\AppData\Local\Temp\322990fa4bd60b0d3a2df87c3543f82bc5e3825f8357eb27a2d80aab0969afa4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 2124
  2⤵
  - Program crash
  PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5064 -ip 5064
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
PID:2844

filelist.dat

Path C:\Users\Admin\AppData\Local\Temp\temp\filelist.dat
Size 30KB
SHA256 b97a19f9ae7247b42dc4614be0b72a6bb4ba6bd057bb9eedd901a38d8f4cf44f
MD5 865136977962fea2dd67931c14bf60b5
SHA1 bebafc23d7b2e8cd0a8bcfb86422f933d182ae6f
SHA512 46581473cfcab33020e00ccc20fd9fbd90f31763303ec391f6ded8d7ee0083320b5149651b366e3e0fcfc56e4b3ab355647093e840d9dbc7c3487194e5cef6bf
SSDEEP 768:XlENn2D8vaWEfJOGMA6+RNX1O6sREfwC4WHJGAVlHPiKAWqCULhxbayUPG4N/ENf:1aKxq5Lh4G4N/ENmvyx2G9yy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5064-0-0x0000000000400000-0x00000000007A7000-memory.dmp

Download

memory/5064-37-0x0000000000400000-0x00000000007A7000-memory.dmp

Download