e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66

Analysis

max time kernel
111s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 13:34

Target

e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66N.exe
Size

653KB
MD5

96f8e652a5d18f95192ee98ff2e79fb0
SHA1

14514b2e36cbb385acef5154bab48a631c3951bd
SHA256

e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66
SHA512

c24b5910c51eb417e74e6e082798d4cba5f9f5c4831ab2a7d261f75818c1185959fe6eea37a5b46c46ca5b4b7b60eed46702fcc05b35eee67684367aded3f7a7
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+6:j7vmp8Rz1GJR8AB+Is9yvr7/jkT

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1640-0-0x000000013F100000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/1640-3-0x000000013F100000-0x000000013F522000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2952	1640	e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66N.exe	31
PID 1640 wrote to memory of 2952	1640	e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66N.exe	31
PID 1640 wrote to memory of 2952	1640	e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66N.exe	31

C:\Users\Admin\AppData\Local\Temp\e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66N.exe
"C:\Users\Admin\AppData\Local\Temp\e83debe546d7d61e3f05d622815ff9301e5de3950c3c034067cfdb4e9147af66N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1640 -s 84
  2⤵
  PID:2952

memory/1640-0-0x000000013F100000-0x000000013F522000-memory.dmp

Filesize
4.1MB

Download
memory/1640-1-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/1640-3-0x000000013F100000-0x000000013F522000-memory.dmp

Filesize
4.1MB

Download