74e7cffd74adfc93a70c107ce0a99532dc22fab3c8c8d2349dd8b06b45f48f0c

Analysis

max time kernel
7s
max time network
4s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31-08-2023 17:58

Target

External-Updated.exe
Size

7.4MB
MD5

5795f40409b29a7a4628d1dd87388f6d
SHA1

318c2ec4f836d5bae3f25b45d98b29680b52b629
SHA256

74e7cffd74adfc93a70c107ce0a99532dc22fab3c8c8d2349dd8b06b45f48f0c
SHA512

d7d85c413795eb736c3d3a6794e5644eff834af38e423029470b19d4c020b7130b840482aebec865239454ce3f683d19bcba2e45d358d33feb43588d203f1da3
SSDEEP

98304:RReYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbECGiv9JTSPhlVtQoK:RsYmOshoKMuIkhVastRL5Di3tKYaSPJg

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2796	External-Updated.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019580-21.dat	upx
behavioral1/files/0x0005000000019580-22.dat	upx
behavioral1/memory/2796-23-0x000007FEF5830000-0x000007FEF5E19000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2796	2184	External-Updated.exe	28
PID 2184 wrote to memory of 2796	2184	External-Updated.exe	28
PID 2184 wrote to memory of 2796	2184	External-Updated.exe	28

C:\Users\Admin\AppData\Local\Temp\External-Updated.exe
"C:\Users\Admin\AppData\Local\Temp\External-Updated.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\External-Updated.exe
  "C:\Users\Admin\AppData\Local\Temp\External-Updated.exe"
  2⤵
  - Loads dropped DLL
  PID:2796

C:\Users\Admin\AppData\Local\Temp\_MEI21842\python311.dll

Filesize
1.6MB

MD5
5f6fd64ec2d7d73ae49c34dd12cedb23

SHA1
c6e0385a868f3153a6e8879527749db52dce4125

SHA256
ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

SHA512
c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21842\python311.dll

Filesize
1.6MB

MD5
5f6fd64ec2d7d73ae49c34dd12cedb23

SHA1
c6e0385a868f3153a6e8879527749db52dce4125

SHA256
ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

SHA512
c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

Download Submit
memory/2796-23-0x000007FEF5830000-0x000007FEF5E19000-memory.dmp

Filesize
5.9MB

Download