flash

g3r7OOQiri.exe

Status: finished
Submission Time: 25.11.2021 18:35:34
Malicious

Comments

Tags

  • exe

Details

  • Analysis ID:
    528755
  • API (Web) ID:
    896281
  • Analysis Started:
    25.11.2021 18:35:36
  • Analysis Finished:
    25.11.2021 18:48:30
  • MD5:
    523928f18d5110ae858049b3e8e7ffe1
  • SHA1:
    741c67937cc564d2d0bb989ab09997ffd6be1296
  • SHA256:
    aef6752333e99c747f01eb9345f03ccbc6a162054dfb705afd7c3040e8219e45
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
56/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Run with higher sleep bypass

malicious
56/100

malicious
10/65

URLs

Name Detection
http://upx.sf.net

Dropped files

Name File Type Hashes Detection
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_g3r7OOQiri.exe_6fba63fe01877644fdd43b959d3cffddf565b3_997a46bd_1936a0ba\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER891B.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Nov 26 02:36:48 2021, 0x1205a4 type
#
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B6E.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
#
Click to see the 3 hidden entries
C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E5D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
#
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
#
C:\Windows\appcompat\Programs\Amcache.hve.LOG1
MS Windows registry file, NT/2000 or above
#