ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-05-2023 11:18

Target

c-realV2.exe
Size

9.8MB
MD5

cf88f81270f9a6abb71bdfacb7c5fc96
SHA1

6a99eb6f3b0b266136f86f81070afe8df4622615
SHA256

ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a
SHA512

6657b2eab3d2af4985d46ca7fc78c92d1cc9a3913b2bbb0182dcd13702e9e58abac7273727afca031bb826f8e9e99c2e881ff7cfe1b0bdd2b9e7b68a04ee9785
SSDEEP

196608:O2RuMeNj9iBqRsj41YWuJ8IcUeOYXOxfOsYk6dnvz16:0TUaYBJ8IcVO/xqdY

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

c-realV2.exe

pid process

1704 c-realV2.exe

pid	process
1704	c-realV2.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI15682\python311.dll	upx
\Users\Admin\AppData\Local\Temp\_MEI15682\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c-realV2.exe

description	pid	process	target process
PID 1568 wrote to memory of 1704	1568	c-realV2.exe	c-realV2.exe
PID 1568 wrote to memory of 1704	1568	c-realV2.exe	c-realV2.exe
PID 1568 wrote to memory of 1704	1568	c-realV2.exe	c-realV2.exe

C:\Users\Admin\AppData\Local\Temp\c-realV2.exe
"C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\c-realV2.exe
"C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"
2⤵
- Loads dropped DLL
PID:1704

C:\Users\Admin\AppData\Local\Temp\_MEI15682\python311.dll
Filesize
1.6MB

MD5
5ef44effa518fc9b3acda79684381d75

SHA1
df6d1a46e691dce3373800b188137eed4ce97dfc

SHA256
90fe310cce48c73f05b7e678a36f2d6bb8870c316b9f12495255b60ad7787777

SHA512
ca52ccd9dedfb03d38544cb2f5a248d52873f7ef143ee3693d2fe11e941e81c5a48da277dbe0cdcf5b01701778ba083d0355fdfef0c13faa59411e7e12e5928c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI15682\python311.dll
Filesize
1.6MB

MD5
5ef44effa518fc9b3acda79684381d75

SHA1
df6d1a46e691dce3373800b188137eed4ce97dfc

SHA256
90fe310cce48c73f05b7e678a36f2d6bb8870c316b9f12495255b60ad7787777

SHA512
ca52ccd9dedfb03d38544cb2f5a248d52873f7ef143ee3693d2fe11e941e81c5a48da277dbe0cdcf5b01701778ba083d0355fdfef0c13faa59411e7e12e5928c

Download Submit