1b979cf9b55e0a2a0d91d39b7d91ee77f732e8c031c25b97d19f52466d6db043

Analysis

max time kernel
110s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 19:20

Target

9be2f8e40a1670d131f6f2812c75f3a0N.exe
Size

653KB
MD5

9be2f8e40a1670d131f6f2812c75f3a0
SHA1

bf9c3add38c019e14e83e99bb79e5298532c3c8b
SHA256

1b979cf9b55e0a2a0d91d39b7d91ee77f732e8c031c25b97d19f52466d6db043
SHA512

72305473654d44814eea7ba20194a4cff867e6f4ce19d9fda7095960a332d4f8129ef809af0878b0d614070a3c284850e0d8d860bc3f97a4e8459f66a6aa464b
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+b:j7vmp8Rz1GJR8AB+Is9yvr7/jkO

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2972-0-0x000000013FCF0000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2972-2-0x000000013FCF0000-0x0000000140112000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2896	2972	9be2f8e40a1670d131f6f2812c75f3a0N.exe	32
PID 2972 wrote to memory of 2896	2972	9be2f8e40a1670d131f6f2812c75f3a0N.exe	32
PID 2972 wrote to memory of 2896	2972	9be2f8e40a1670d131f6f2812c75f3a0N.exe	32

C:\Users\Admin\AppData\Local\Temp\9be2f8e40a1670d131f6f2812c75f3a0N.exe
"C:\Users\Admin\AppData\Local\Temp\9be2f8e40a1670d131f6f2812c75f3a0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 84
  2⤵
  PID:2896

memory/2972-0-0x000000013FCF0000-0x0000000140112000-memory.dmp

Filesize
4.1MB

Download
memory/2972-1-0x0000000000300000-0x0000000000320000-memory.dmp

Filesize
128KB

Download
memory/2972-2-0x000000013FCF0000-0x0000000140112000-memory.dmp

Filesize
4.1MB

Download