d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099

Analysis

max time kernel
111s
max time network
15s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:41

Target

d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099N.exe
Size

653KB
MD5

e4de8b1a072b607e2feb3d53b3f91b10
SHA1

b28ba8e93fc0217b16cfe27ae67653ca7f5b01ff
SHA256

d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099
SHA512

36894d38b79b2ece76698d338223ade971a2a297321bbecad503a8dbf3a8715077599292bf1cce1d90d7c19c4affdc4df656a9fec584823b096c5fe76dea9f23
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+K:j7vmp8Rz1GJR8AB+Is9yvr7/jkT

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2148-0-0x000000013FD40000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2148-2-0x000000013FD40000-0x0000000140162000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2132	2148	d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099N.exe	31
PID 2148 wrote to memory of 2132	2148	d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099N.exe	31
PID 2148 wrote to memory of 2132	2148	d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099N.exe	31

C:\Users\Admin\AppData\Local\Temp\d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099N.exe
"C:\Users\Admin\AppData\Local\Temp\d760c8cd42b71dfef93d72c058033c67b3da3d5203a09ca7658064450413c099N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2148 -s 84
  2⤵
  PID:2132

memory/2148-0-0x000000013FD40000-0x0000000140162000-memory.dmp

Filesize
4.1MB

Download
memory/2148-1-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download
memory/2148-2-0x000000013FD40000-0x0000000140162000-memory.dmp

Filesize
4.1MB

Download