ddc5fe92804fe425a23e74fdbb43e8459acc7bfe1f7bf61486f6639eb1aa5bc3

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:36

Target

TimeFN_v3.exe
Size

19.2MB
MD5

4c9c8808abf1503bd7402be6d67df2f3
SHA1

5c9924f85fc74035c8e12f25354fcfc4b15d0970
SHA256

ddc5fe92804fe425a23e74fdbb43e8459acc7bfe1f7bf61486f6639eb1aa5bc3
SHA512

21da792a506bd2ae4db5050460e9e709aa1abbfd82ca49a47a1feab967d73c529dd89797844d40024bf91a7df44b36818e19d491e3005291cd23ab21e5310056
SSDEEP

393216:dflqCJ/m3paqm7QfXCOpwtXn5AoeoMZpcfnFJWf0f6gBsJV:dflqCJKaqjPYtXfez4fFJWf0fpBs

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI10882\python310.dll	upx
\Users\Admin\AppData\Local\Temp\_MEI10882\python310.dll	upx

Loads dropped DLL 1 IoCs

Processes:

TimeFN_v3.exe

pid process

1800 TimeFN_v3.exe

pid	process
1800	TimeFN_v3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

TimeFN_v3.exe

description	pid	process	target process
PID 1088 wrote to memory of 1800	1088	TimeFN_v3.exe	TimeFN_v3.exe
PID 1088 wrote to memory of 1800	1088	TimeFN_v3.exe	TimeFN_v3.exe
PID 1088 wrote to memory of 1800	1088	TimeFN_v3.exe	TimeFN_v3.exe

C:\Users\Admin\AppData\Local\Temp\TimeFN_v3.exe
"C:\Users\Admin\AppData\Local\Temp\TimeFN_v3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\TimeFN_v3.exe
"C:\Users\Admin\AppData\Local\Temp\TimeFN_v3.exe"
2⤵
- Loads dropped DLL
PID:1800

C:\Users\Admin\AppData\Local\Temp\_MEI10882\python310.dll
Filesize
1.5MB

MD5
fd06363dde36c2a936fa551cac2e9a02

SHA1
832464285b0ea7e08f8a82b0beea17c213b89d76

SHA256
aa8225957264a0e04d219105fb7313a09ea536978ae23479649a3f81a110e976

SHA512
3df9b8a8ebe7d3232cedec043aa31e761470152b1a88c1bb0a4c6f484a96579c05faecbfa2e9d123b68ac905fe1e78fd2df78435172e524c3010aa8ac8438cbc

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI10882\python310.dll
Filesize
1.5MB

MD5
fd06363dde36c2a936fa551cac2e9a02

SHA1
832464285b0ea7e08f8a82b0beea17c213b89d76

SHA256
aa8225957264a0e04d219105fb7313a09ea536978ae23479649a3f81a110e976

SHA512
3df9b8a8ebe7d3232cedec043aa31e761470152b1a88c1bb0a4c6f484a96579c05faecbfa2e9d123b68ac905fe1e78fd2df78435172e524c3010aa8ac8438cbc

Download Submit
memory/1088-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/1800-55-0x0000000000000000-mapping.dmp

Download
memory/1800-59-0x000007FEF6600000-0x000007FEF6A6F000-memory.dmp

Filesize
4.4MB

Download