4c6102dd1ff391743c9e371f976573131c19bbc92fc8e83c20136527ed5f2567

Resubmissions

05/05/2023, 10:23

05/05/2023, 10:18

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/05/2023, 10:23

Target

Synapse Launcher.exe
Size

23.9MB
MD5

79e8901222b0547447857dc08fcabfff
SHA1

ee9ae6ca7d9b85643b18c39063af77104d2e9e99
SHA256

4c6102dd1ff391743c9e371f976573131c19bbc92fc8e83c20136527ed5f2567
SHA512

2705df59ae94da249eab6e77e3e5641d413d7b28b0e61cfce3e8d9bab231336e648b95a084798043183d90905d6a714ee88f7b820557779ac9f369fbd44f0556
SSDEEP

393216:gxAlniYXPu8BRq/m3pznlPSF3VqevE8LzdChd1lr:1liYXP5qKznlEqescsl

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
548	Synapse Launcher.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016c15-156.dat	upx
behavioral1/files/0x0006000000016c15-157.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 548	2032	Synapse Launcher.exe	27
PID 2032 wrote to memory of 548	2032	Synapse Launcher.exe	27
PID 2032 wrote to memory of 548	2032	Synapse Launcher.exe	27

C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Synapse Launcher.exe"
  2⤵
  - Loads dropped DLL
  PID:548

C:\Users\Admin\AppData\Local\Temp\_MEI20322\python311.dll

Filesize
1.6MB

MD5
53b1a9474ddc3a31adf72011dc8da780

SHA1
36f476d318acca6a12d3625b02cb14ab19534db7

SHA256
357e545f47b605682328566a8df692dc22e4ea2ab37686788c3416b3813addc7

SHA512
290c070eaf324476bfda676fc547ee42479a239b11192b654604862d53de1f1752a2f1b212dc15b3a22787a6469d6ec22ced98b7bb7d5f7c618602bbd12b7881

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20322\python311.dll

Filesize
1.6MB

MD5
53b1a9474ddc3a31adf72011dc8da780

SHA1
36f476d318acca6a12d3625b02cb14ab19534db7

SHA256
357e545f47b605682328566a8df692dc22e4ea2ab37686788c3416b3813addc7

SHA512
290c070eaf324476bfda676fc547ee42479a239b11192b654604862d53de1f1752a2f1b212dc15b3a22787a6469d6ec22ced98b7bb7d5f7c618602bbd12b7881

Download Submit
memory/548-158-0x000007FEF6810000-0x000007FEF6DFA000-memory.dmp

Filesize
5.9MB

Download