8e4ce102a531d540a1f643396d6ddfc0da9acc963ca995bcba9d07909ebb58e0

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-02-2023 18:56

Target

luna_new.exe
Size

16.3MB
MD5

771f78eec820f0d6c6a160ad99cbe9c7
SHA1

3808c4f9e5f6515d941cf5bb1e310cab44382d6c
SHA256

8e4ce102a531d540a1f643396d6ddfc0da9acc963ca995bcba9d07909ebb58e0
SHA512

83438bd2fb28401ed480f8934c0ec9f9bb04d0e5f8c20da04d1cc9ff07427e104c7dacc237b61a364a41c7e8855a14b3706b63a2beb6290bf0f4f2379a6b6901
SSDEEP

393216:hxAlndYX5fT6K4/m3pFFqyoBgsSzUG9TRx7:MldYX5fWK4Ky1HGRRx7

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

luna_new.exe

pid process

956 luna_new.exe

pid	process
956	luna_new.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll	upx
\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

luna_new.exe

description	pid	process	target process
PID 1712 wrote to memory of 956	1712	luna_new.exe	luna_new.exe
PID 1712 wrote to memory of 956	1712	luna_new.exe	luna_new.exe
PID 1712 wrote to memory of 956	1712	luna_new.exe	luna_new.exe

C:\Users\Admin\AppData\Local\Temp\luna_new.exe
"C:\Users\Admin\AppData\Local\Temp\luna_new.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\luna_new.exe
"C:\Users\Admin\AppData\Local\Temp\luna_new.exe"
2⤵
- Loads dropped DLL
PID:956

C:\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll
Filesize
1.4MB

MD5
bbcb74867bd3f8a691b1f0a394336908

SHA1
aea4b231b9f09bedcd5ce02e1962911edd4b35ad

SHA256
800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41

SHA512
00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll
Filesize
1.4MB

MD5
bbcb74867bd3f8a691b1f0a394336908

SHA1
aea4b231b9f09bedcd5ce02e1962911edd4b35ad

SHA256
800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41

SHA512
00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481

Download Submit
memory/956-55-0x0000000000000000-mapping.dmp

Download
memory/956-59-0x000007FEF5F70000-0x000007FEF63DE000-memory.dmp

Filesize
4.4MB

Download
memory/1712-54-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp

Filesize
8KB

Download