ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80

Analysis

max time kernel
140s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 04:47

Target

ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80.exe
Size

653KB
MD5

b53f50893a01b6b724d5fc6170e7d3db
SHA1

69113d3db91ee529a1385b2c7187b740af05fc7d
SHA256

ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80
SHA512

859e595dbf34caf169b9d4bbef19c90d9a76f52c198a9663331df87721e46711aedff81b39b4807c9ced0ee0916c09c66454c6b8545d8f725ea58ec0366c651b
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+H:j7vmp8Rz1GJR8AB+Is9yvr7/jku

Score

5^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1972-0-0x000000013FF70000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/1972-3-0x000000013FF70000-0x0000000140392000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2824	1972	ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80.exe	30
PID 1972 wrote to memory of 2824	1972	ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80.exe	30
PID 1972 wrote to memory of 2824	1972	ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80.exe	30

C:\Users\Admin\AppData\Local\Temp\ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80.exe
"C:\Users\Admin\AppData\Local\Temp\ff88b18175a52fe194d4b1e2a2f007563f9f0729886a0e2d927a1c17fb91ae80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 84
  2⤵
  PID:2824

memory/1972-0-0x000000013FF70000-0x0000000140392000-memory.dmp

Filesize
4.1MB

Download
memory/1972-1-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/1972-3-0x000000013FF70000-0x0000000140392000-memory.dmp

Filesize
4.1MB

Download