af17320a77ca07f6cfcde640ad068b0972b6b2b4748fa4ac096a059949a9845c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 21:25

Target

10b8646f911012f0f073c2bca8163cb0N.exe
Size

653KB
MD5

10b8646f911012f0f073c2bca8163cb0
SHA1

5d3fcc6fbd8182f0db8cd0f82e6b23e40d012584
SHA256

af17320a77ca07f6cfcde640ad068b0972b6b2b4748fa4ac096a059949a9845c
SHA512

eb6b60ec23fde3fe617d313b849072637aa22f430375d296c8869ae81e106ceeb8f58f11cbfee1ad24847f527ea7395098ce28e1db0a328301b634d54e238b87
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+l:j7vmp8Rz1GJR8AB+Is9yvr7/jk0

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2604-1-0x000000013FAB0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2604-2-0x000000013FAB0000-0x000000013FED2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2648	2604	10b8646f911012f0f073c2bca8163cb0N.exe	31
PID 2604 wrote to memory of 2648	2604	10b8646f911012f0f073c2bca8163cb0N.exe	31
PID 2604 wrote to memory of 2648	2604	10b8646f911012f0f073c2bca8163cb0N.exe	31

C:\Users\Admin\AppData\Local\Temp\10b8646f911012f0f073c2bca8163cb0N.exe
"C:\Users\Admin\AppData\Local\Temp\10b8646f911012f0f073c2bca8163cb0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2604 -s 84
  2⤵
  PID:2648

memory/2604-1-0x000000013FAB0000-0x000000013FED2000-memory.dmp

Filesize
4.1MB

Download
memory/2604-0-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download
memory/2604-2-0x000000013FAB0000-0x000000013FED2000-memory.dmp

Filesize
4.1MB

Download