e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 02:31

Target

e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a.exe
Size

653KB
MD5

8de661237252202c8ac73a9687878735
SHA1

1bc4c4e24028c51c4b2628bb81ce3406c96ca67d
SHA256

e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a
SHA512

5bed74aa9d37139a597c192f120f7c3fa09d52d579843fdd0f67741b55d996013c3d6d1a760cbcddd15a003501a4405478cb3237f56a4eedef60f9d75c80409f
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+E:j7vmp8Rz1GJR8AB+Is9yvr7/jkR

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2336-0-0x000000013FB40000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2336-3-0x000000013FB40000-0x000000013FF62000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3048	2336	e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a.exe	31
PID 2336 wrote to memory of 3048	2336	e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a.exe	31
PID 2336 wrote to memory of 3048	2336	e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a.exe	31

C:\Users\Admin\AppData\Local\Temp\e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a.exe
"C:\Users\Admin\AppData\Local\Temp\e0d89a01c56e34c05fbaa8e796a0903cc5cbab6181ed78822a024d2c4e4f2b2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2336 -s 84
  2⤵
  PID:3048

memory/2336-0-0x000000013FB40000-0x000000013FF62000-memory.dmp

Filesize
4.1MB

Download
memory/2336-1-0x00000000001F0000-0x0000000000210000-memory.dmp

Filesize
128KB

Download
memory/2336-3-0x000000013FB40000-0x000000013FF62000-memory.dmp

Filesize
4.1MB

Download