b27da45373b14f046650631fe3135d3675d98bf4b2283e6085354800377de397

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-04-2023 01:32

Target

immortal bulider.exe
Size

15.9MB
MD5

c92e894cc5a2427ce1f018d6b9d19de2
SHA1

8441446c4c6afbc32f219594683df5d5dab12c66
SHA256

b27da45373b14f046650631fe3135d3675d98bf4b2283e6085354800377de397
SHA512

9e1a318d2a8d556c03234c1047151ab1f1931ed657143914b8746dd635a450f014924e0047f08a6bce7028ad5ef9b190f8bb9d15d0bcee18675d0d67c2c7e70f
SSDEEP

393216:pqPnLFux/m3pEDOEkSgsvbhz2z4TMM4CBIkv3DJ9m:gPLFuxKpAV0DM4CBIS2

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
896	immortal bulider.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016c23-166.dat	upx
behavioral1/files/0x0006000000016c23-167.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 896	1804	immortal bulider.exe	28
PID 1804 wrote to memory of 896	1804	immortal bulider.exe	28
PID 1804 wrote to memory of 896	1804	immortal bulider.exe	28

C:\Users\Admin\AppData\Local\Temp\immortal bulider.exe
"C:\Users\Admin\AppData\Local\Temp\immortal bulider.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\immortal bulider.exe
  "C:\Users\Admin\AppData\Local\Temp\immortal bulider.exe"
  2⤵
  - Loads dropped DLL
  PID:896

C:\Users\Admin\AppData\Local\Temp\_MEI18042\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18042\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
memory/896-168-0x000007FEF62C0000-0x000007FEF672E000-memory.dmp

Filesize
4.4MB

Download