8b6bb53f8f87e5f7ba16e91b3354469ab6530936b3672177450a0b05ddace599

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
25-10-2023 19:45

Target

Creal_JC.exe
Size

12.0MB
MD5

f54c46ecf68d509b47b11070ec7afffe
SHA1

79e132011aa4b630e1dde94b0c2e5a3aaaa60f85
SHA256

8b6bb53f8f87e5f7ba16e91b3354469ab6530936b3672177450a0b05ddace599
SHA512

76d28e49f5c93acb5e0ed46f0b663e306aaf5ab2fd6e1783b8d6cb40419d7380cf467ee584d604853efacd815cf0a03dd0efb729eb98d6c49253ace8a0d8fbef
SSDEEP

196608:q44RGdM80sKYu/PaQdXGnJ2/NsRHvUWvo3hxqno/w3iFCxa55QbRzXNgzaF00/hq:aUdM2QdXGieRHdcxOo/w3uCxEQb0uF0G

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3024	Creal_JC.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001949a-82.dat	upx
behavioral1/files/0x000500000001949a-83.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 3024	1928	Creal_JC.exe	28
PID 1928 wrote to memory of 3024	1928	Creal_JC.exe	28
PID 1928 wrote to memory of 3024	1928	Creal_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\Creal_JC.exe
"C:\Users\Admin\AppData\Local\Temp\Creal_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\Creal_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\Creal_JC.exe"
  2⤵
  - Loads dropped DLL
  PID:3024

C:\Users\Admin\AppData\Local\Temp\_MEI19282\python310.dll

Filesize
1.4MB

MD5
37bca234095b34b410f9c76e8aabc048

SHA1
cee23e641535fe5724f5af0e68df2b2c98fe5b0b

SHA256
a7c9926a4a279d2fa2a0b4b8adcececc4e1009b0b08d2e689168068d08457cbe

SHA512
9a89c50c54d5ff92bd36dd37d0d5b6a8320dc9702259fbb5d0ef1296396a9cf20e84b4dad86ea627b257682da2346b44aeabc4074d231f50705f3533126f4bec

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI19282\python310.dll

Filesize
1.4MB

MD5
37bca234095b34b410f9c76e8aabc048

SHA1
cee23e641535fe5724f5af0e68df2b2c98fe5b0b

SHA256
a7c9926a4a279d2fa2a0b4b8adcececc4e1009b0b08d2e689168068d08457cbe

SHA512
9a89c50c54d5ff92bd36dd37d0d5b6a8320dc9702259fbb5d0ef1296396a9cf20e84b4dad86ea627b257682da2346b44aeabc4074d231f50705f3533126f4bec

Download Submit
memory/3024-84-0x000007FEF6490000-0x000007FEF68F5000-memory.dmp

Filesize
4.4MB

Download