127d6478204ae415bd25cbffa8d621df992d5d93de04322b85cec601b7eb30b3

Analysis

max time kernel
26s
max time network
31s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 19:10

Target

Built.exe
Size

5.9MB
MD5

c1fac3f06c13956f35cdf350ba2e5068
SHA1

8f1d705c4f7cdb4d7d2661cd54b9aa2d3a1ae68b
SHA256

127d6478204ae415bd25cbffa8d621df992d5d93de04322b85cec601b7eb30b3
SHA512

5bb4ca8af1dfa7cd47109afd29f5cfb124089fedd1ef088b717a028f135592eb537c8e821f9cad9c02ed5c7250958caa14e9b00217f11e96b8dd963339324093
SSDEEP

98304:qwfrAEHFi65sn6Wfz7pnxCb3AtZC0VZHtKpbzU8SG2XAVHUCVJUZjkMSS69GPHgQ:qIrAEXDOYbwtZVZibQpG2QhzJ5Mv6Id

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2980	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000600000001493f-75.dat	upx
behavioral1/files/0x000600000001493f-76.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2980	2144	Built.exe	28
PID 2144 wrote to memory of 2980	2144	Built.exe	28
PID 2144 wrote to memory of 2980	2144	Built.exe	28

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2980

C:\Users\Admin\AppData\Local\Temp\_MEI21442\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21442\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
memory/2980-77-0x000007FEF5B10000-0x000007FEF5F7E000-memory.dmp

Filesize
4.4MB

Download