Analysis

  • max time kernel
    14s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 11:19

General

  • Target

    29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe

  • Size

    653KB

  • MD5

    feea6d31061ca6e6d6f9ceb0c0d6e220

  • SHA1

    3b14af425cc5208ee5a32f321f8eeccaa6714a79

  • SHA256

    29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16

  • SHA512

    6950f7d06954e8e77d4f91ae8840137bc7ea645f1bb2892558a1b3a88f2aaa81625d833c55cbbf526d1d05ed9b6386b6b75aaeab16ccf23a065848ca3dd931db

  • SSDEEP

    12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+O:j7vmp8Rz1GJR8AB+Is9yvr7/jkH

Score
5/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe
    "C:\Users\Admin\AppData\Local\Temp\29f4a7060325873f60f980b0b761e5b373d5ce4054b0aaa0d8d58efa429d0e16N.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1832 -s 84
      2⤵
        PID:1268

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1832-0-0x000000013F440000-0x000000013F862000-memory.dmp

            Filesize

            4.1MB

          • memory/1832-1-0x0000000000300000-0x0000000000320000-memory.dmp

            Filesize

            128KB

          • memory/1832-3-0x000000013F440000-0x000000013F862000-memory.dmp

            Filesize

            4.1MB