1064ba8718be72286c8c6045473a4170522b7fb24c83cd799c6c179f809b5a37

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27-11-2023 10:22

Target

RUNECE/RUNECE/RUNECE/RUNE_CE.exe
Size

20.4MB
MD5

dcea4e9b917bcf38dcf78f8e68ed9eb0
SHA1

c9235a2e2f7976ab8edc24d071777592e0c9a348
SHA256

e745b5aa36ab3f24090209ef3aedfa33b8400421dc11b52275e53c8f0a47d3a0
SHA512

f0e13a6a1c054b3fd47e3eab9af1fbf65f8f679c11e375e21f2dabf8bb3daad5ec0d1909bbaf342fa077faf4306c1ec0748f4cdd4ec9176d0dd6b0e533e35732
SSDEEP

393216:9Wvz+XOVzrlICtL+9qzTfgD7fEUyIcY/Vt1Wom6:Iz+XOxiA+9q/fq7fEbItpm6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2680	RUNE_CE.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/files/0x000400000001cd0c-88.dat	upx
behavioral5/files/0x000400000001cd0c-89.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2680	1980	RUNE_CE.exe	28
PID 1980 wrote to memory of 2680	1980	RUNE_CE.exe	28
PID 1980 wrote to memory of 2680	1980	RUNE_CE.exe	28

C:\Users\Admin\AppData\Local\Temp\RUNECE\RUNECE\RUNECE\RUNE_CE.exe
"C:\Users\Admin\AppData\Local\Temp\RUNECE\RUNECE\RUNECE\RUNE_CE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\RUNECE\RUNECE\RUNECE\RUNE_CE.exe
  "C:\Users\Admin\AppData\Local\Temp\RUNECE\RUNECE\RUNECE\RUNE_CE.exe"
  2⤵
  - Loads dropped DLL
  PID:2680

C:\Users\Admin\AppData\Local\Temp\_MEI19802\python312.dll

Filesize
1.7MB

MD5
552ef97cdbebf443304b7514bb50e950

SHA1
8d5f5286ee7d4d64ebefb99ea48a5d88ad2e38cc

SHA256
888b1eea6ffed7188cb3b82558267fc6fdd3930ea98c9f6801bcb728b02ed538

SHA512
c8f0e960831b0bb2bffd5f3d490086002b74499d863488e515d7b755e01e97bc967dce7b211f059ce6046dc6f8f694140456046ba2773903f4b32d7ab38fc325

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI19802\python312.dll

Filesize
1.7MB

MD5
552ef97cdbebf443304b7514bb50e950

SHA1
8d5f5286ee7d4d64ebefb99ea48a5d88ad2e38cc

SHA256
888b1eea6ffed7188cb3b82558267fc6fdd3930ea98c9f6801bcb728b02ed538

SHA512
c8f0e960831b0bb2bffd5f3d490086002b74499d863488e515d7b755e01e97bc967dce7b211f059ce6046dc6f8f694140456046ba2773903f4b32d7ab38fc325

Download Submit
memory/2680-90-0x000007FEF5780000-0x000007FEF5E50000-memory.dmp

Filesize
6.8MB

Download