e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 08:00

Target

e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1.exe
Size

484KB
MD5

1ee85fc8201c7843a8c3c7977043d48a
SHA1

957e1144a603f1e3ca4fd6fdfa2d96dcd07577c7
SHA256

e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1
SHA512

5b5cec28f73533bca3e7735e6e9ba91ec813101f8e7d3aa14f837b25853e9c1068411f4369b1fe79c9087ceb59bd390b0fb153af75d2e556b8ad81b1ab0aaa67
SSDEEP

12288:bnfpxtq81e1pIX0OMNY0Q0+UwvSPekSFYZyeTg02baGcOof:bR+cefFOMNc0q6PekKCDN2baGcOW

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2656-0-0x0000000000400000-0x000000000053A000-memory.dmp	upx
behavioral1/memory/2656-19-0x0000000000400000-0x000000000053A000-memory.dmp	upx
behavioral1/memory/2656-20-0x0000000000400000-0x000000000053A000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2656	e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2612	2656	e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1.exe	28
PID 2656 wrote to memory of 2612	2656	e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1.exe	28
PID 2656 wrote to memory of 2612	2656	e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1.exe	28

C:\Users\Admin\AppData\Local\Temp\e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1.exe
"C:\Users\Admin\AppData\Local\Temp\e0e432d9269ac847b1951b5e70f28c0450657f93f99d2ae604744df1f5a10cb1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2656 -s 52
  2⤵
  PID:2612

memory/2656-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2656-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2656-19-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2656-21-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2656-20-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download