d332de690f202780e5bedbaeeafac4d45a1d8a02e0d8267a5603d452ee7c1b07

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 14:13

Target

Nicht bestätigt 961354.exe
Size

20.5MB
MD5

e90c068938f94007bb753a5360f71935
SHA1

8467f19d0eee8bf2eff1b05d23dc6a23fef091db
SHA256

d332de690f202780e5bedbaeeafac4d45a1d8a02e0d8267a5603d452ee7c1b07
SHA512

f4f8d24d68d4179fc626d5a6cfbbd8adfb8c714876e5889d35b6a5fb54222fc042a6e95daf0fa60ae9da51d62f208d48cc08b42e16992af678e9d1b8594263bc
SSDEEP

393216:5Wvz+XOVzpICtL+9qzTfgD7fEUyIeY/Vt1WomY:Ez+XOxKA+9q/fq7fEbITpmY

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3008	Nicht bestätigt 961354.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019bfe-88.dat	upx
behavioral1/files/0x0005000000019bfe-89.dat	upx
behavioral1/memory/3008-90-0x000007FEF5E50000-0x000007FEF6520000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3008	1984	Nicht bestätigt 961354.exe	28
PID 1984 wrote to memory of 3008	1984	Nicht bestätigt 961354.exe	28
PID 1984 wrote to memory of 3008	1984	Nicht bestätigt 961354.exe	28

C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 961354.exe
"C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 961354.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 961354.exe
  "C:\Users\Admin\AppData\Local\Temp\Nicht bestätigt 961354.exe"
  2⤵
  - Loads dropped DLL
  PID:3008

C:\Users\Admin\AppData\Local\Temp\_MEI19842\python312.dll

Filesize
1.7MB

MD5
552ef97cdbebf443304b7514bb50e950

SHA1
8d5f5286ee7d4d64ebefb99ea48a5d88ad2e38cc

SHA256
888b1eea6ffed7188cb3b82558267fc6fdd3930ea98c9f6801bcb728b02ed538

SHA512
c8f0e960831b0bb2bffd5f3d490086002b74499d863488e515d7b755e01e97bc967dce7b211f059ce6046dc6f8f694140456046ba2773903f4b32d7ab38fc325

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI19842\python312.dll

Filesize
1.7MB

MD5
552ef97cdbebf443304b7514bb50e950

SHA1
8d5f5286ee7d4d64ebefb99ea48a5d88ad2e38cc

SHA256
888b1eea6ffed7188cb3b82558267fc6fdd3930ea98c9f6801bcb728b02ed538

SHA512
c8f0e960831b0bb2bffd5f3d490086002b74499d863488e515d7b755e01e97bc967dce7b211f059ce6046dc6f8f694140456046ba2773903f4b32d7ab38fc325

Download Submit
memory/3008-90-0x000007FEF5E50000-0x000007FEF6520000-memory.dmp

Filesize
6.8MB

Download