4273aa371116f56c43f5b840ffcf514bf970ca166b593a6884e57478c5da4283

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 11:59

Target

WindowsEditor.exe
Size

8.3MB
MD5

a01276baf7cab0051f9a7f6950754022
SHA1

875d179796dc7660b2f016f384958284f2ea0c67
SHA256

4273aa371116f56c43f5b840ffcf514bf970ca166b593a6884e57478c5da4283
SHA512

93a3aa034491c32ba68ebee715b467c5589e325b4c75490f2a5ea41b0d54f562c8b37ab92b17c32f984da336aed617b2e91ca41c90c2558a420933ceef0a9acb
SSDEEP

196608:I3pb7KX/HdN16B6yYnlPzf+JiT4n3XWKsMvtBVYP3hzHK:GYXPwBRYnlPSF3VvvtT4

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1320	WindowsEditor.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0008000000012326-57.dat	upx
behavioral1/files/0x0008000000012326-58.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1320	1472	WindowsEditor.exe	28
PID 1472 wrote to memory of 1320	1472	WindowsEditor.exe	28
PID 1472 wrote to memory of 1320	1472	WindowsEditor.exe	28

C:\Users\Admin\AppData\Local\Temp\WindowsEditor.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsEditor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\WindowsEditor.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsEditor.exe"
  2⤵
  - Loads dropped DLL
  PID:1320

C:\Users\Admin\AppData\Local\Temp\_MEI14722\python311.dll

Filesize
1.6MB

MD5
53b1a9474ddc3a31adf72011dc8da780

SHA1
36f476d318acca6a12d3625b02cb14ab19534db7

SHA256
357e545f47b605682328566a8df692dc22e4ea2ab37686788c3416b3813addc7

SHA512
290c070eaf324476bfda676fc547ee42479a239b11192b654604862d53de1f1752a2f1b212dc15b3a22787a6469d6ec22ced98b7bb7d5f7c618602bbd12b7881

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14722\python311.dll

Filesize
1.6MB

MD5
53b1a9474ddc3a31adf72011dc8da780

SHA1
36f476d318acca6a12d3625b02cb14ab19534db7

SHA256
357e545f47b605682328566a8df692dc22e4ea2ab37686788c3416b3813addc7

SHA512
290c070eaf324476bfda676fc547ee42479a239b11192b654604862d53de1f1752a2f1b212dc15b3a22787a6469d6ec22ced98b7bb7d5f7c618602bbd12b7881

Download Submit
memory/1320-55-0x0000000000000000-mapping.dmp

Download
memory/1320-59-0x000007FEF5F60000-0x000007FEF654A000-memory.dmp

Filesize
5.9MB

Download
memory/1472-54-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download