f3aae6d67660d40ec22b5e4d9d7f52a13cccbeb02ae2acbd02b4b5c145b1ebf0

Analysis

max time kernel
110s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 22:25

Target

1dded9a116818dab6a6f6c2d938b69c0N.exe
Size

653KB
MD5

1dded9a116818dab6a6f6c2d938b69c0
SHA1

ef4f03fff797337de2bcc82972fe03c3b59388ad
SHA256

f3aae6d67660d40ec22b5e4d9d7f52a13cccbeb02ae2acbd02b4b5c145b1ebf0
SHA512

b033af1b67122fa1ef072e37ba49326d004407f3ac011db28f586a08be54600133335d965630d20290c04350f25091f748c44e20df585121e08ecca138707bdf
SSDEEP

12288:kbQ06/iIb7kcUV6PwBicPeyqA9pULZR4c1JCgZq5bwbPhk79ZCGDFu:k8YIb7kbiGem9G4kZqiC5ZCG8

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2692-1-0x000000013F030000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2692-2-0x000000013F030000-0x000000013F452000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2760	2692	1dded9a116818dab6a6f6c2d938b69c0N.exe	32
PID 2692 wrote to memory of 2760	2692	1dded9a116818dab6a6f6c2d938b69c0N.exe	32
PID 2692 wrote to memory of 2760	2692	1dded9a116818dab6a6f6c2d938b69c0N.exe	32

C:\Users\Admin\AppData\Local\Temp\1dded9a116818dab6a6f6c2d938b69c0N.exe
"C:\Users\Admin\AppData\Local\Temp\1dded9a116818dab6a6f6c2d938b69c0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 84
  2⤵
  PID:2760

memory/2692-0-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/2692-1-0x000000013F030000-0x000000013F452000-memory.dmp

Filesize
4.1MB

Download
memory/2692-2-0x000000013F030000-0x000000013F452000-memory.dmp

Filesize
4.1MB

Download