cfcaffa04a3997d8d809584797103c0647641c2e15e3c84f8233ca0d4dd63e85

Resubmissions

07-06-2023 20:04

07-06-2023 18:02

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-06-2023 18:02

Target

server boost generator.exe
Size

7.3MB
MD5

30c0cf620581793a647f2e6661b5d347
SHA1

99d25eab942605fddfa6baf846f53c4dc7372bfb
SHA256

cfcaffa04a3997d8d809584797103c0647641c2e15e3c84f8233ca0d4dd63e85
SHA512

5510d10bc20820713b91a84f73c45a52a8f1e36608fa5f7c1794ef5af8b9657c2ad8474fab698dc8638c034ff1a0daee599c43644f834d72d6ce3a6d854b62df
SSDEEP

196608:urih8Fwj5aeNyFJMIDJpJgsAGKyRtiCWVYIDxs:CLFMyFqypJgsht7WVYYs

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
656	server boost generator.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00060000000142cc-80.dat	upx
behavioral1/files/0x00060000000142cc-81.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 656	1312	server boost generator.exe	28
PID 1312 wrote to memory of 656	1312	server boost generator.exe	28
PID 1312 wrote to memory of 656	1312	server boost generator.exe	28

C:\Users\Admin\AppData\Local\Temp\server boost generator.exe
"C:\Users\Admin\AppData\Local\Temp\server boost generator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\server boost generator.exe
  "C:\Users\Admin\AppData\Local\Temp\server boost generator.exe"
  2⤵
  - Loads dropped DLL
  PID:656

C:\Users\Admin\AppData\Local\Temp\_MEI13122\python310.dll

Filesize
1.4MB

MD5
bbcb74867bd3f8a691b1f0a394336908

SHA1
aea4b231b9f09bedcd5ce02e1962911edd4b35ad

SHA256
800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41

SHA512
00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI13122\python310.dll

Filesize
1.4MB

MD5
bbcb74867bd3f8a691b1f0a394336908

SHA1
aea4b231b9f09bedcd5ce02e1962911edd4b35ad

SHA256
800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41

SHA512
00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481

Download Submit
memory/656-82-0x000007FEF6620000-0x000007FEF6A8E000-memory.dmp

Filesize
4.4MB

Download