ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 01:18

Target

ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678.exe
Size

653KB
MD5

5be54859f1ea64961a295a5b21f0cb55
SHA1

6e43499c6fff5c8421c2d2d536de07368838532f
SHA256

ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678
SHA512

53525cd4c0e6132fe119841f13799172acf5895a291576d737fd6e82bccc0bbc52937a1d2565f0fe1d9c29ea3aec99efe11a0fe6e3999c01fa2f540fa4ecb043
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+E:j7vmp8Rz1GJR8AB+Is9yvr7/jk1

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2488-0-0x000000013F200000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2488-2-0x000000013F200000-0x000000013F622000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2232	2488	ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678.exe	32
PID 2488 wrote to memory of 2232	2488	ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678.exe	32
PID 2488 wrote to memory of 2232	2488	ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678.exe	32

C:\Users\Admin\AppData\Local\Temp\ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678.exe
"C:\Users\Admin\AppData\Local\Temp\ac2d021d5bbb571e1b7866cf0b8b3ed3037888d134a7fdeb9c22d5398cc59678.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2488 -s 84
  2⤵
  PID:2232

memory/2488-0-0x000000013F200000-0x000000013F622000-memory.dmp

Filesize
4.1MB

Download
memory/2488-1-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/2488-2-0x000000013F200000-0x000000013F622000-memory.dmp

Filesize
4.1MB

Download