2a1a8f4f8a42ed7fb7bcc3dcc4fde0acd6db267784cbc3431852b2882c4c6ae1

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11-12-2023 21:20

Target

GOBLIN SERVICES.exe
Size

78.7MB
MD5

cb58033d333ce4d39c63978535e3d91e
SHA1

b5740b3fe890a511f7524c88b1f45845ef3333a6
SHA256

2a1a8f4f8a42ed7fb7bcc3dcc4fde0acd6db267784cbc3431852b2882c4c6ae1
SHA512

d17c468837f5de45217e5421049f2a31fd9d67b2b5f5d8e2755ba4de4ad60c15d6b49d4e949cc22403ba939b796bf97f81371ef30a6d3aadc805d001b538ca58
SSDEEP

1572864:M2MbiJR5Q3j88pSk8IpG7V+VPhqHnE7gwjCi9WlsnghowmaOll4WmVSzsWX:MZbC+7SkB05awHMuiMsghfxOll4j8z

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2732	GOBLIN SERVICES.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cc68-1259.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2732	2060	GOBLIN SERVICES.exe	28
PID 2060 wrote to memory of 2732	2060	GOBLIN SERVICES.exe	28
PID 2060 wrote to memory of 2732	2060	GOBLIN SERVICES.exe	28

C:\Users\Admin\AppData\Local\Temp\GOBLIN SERVICES.exe
"C:\Users\Admin\AppData\Local\Temp\GOBLIN SERVICES.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\GOBLIN SERVICES.exe
  "C:\Users\Admin\AppData\Local\Temp\GOBLIN SERVICES.exe"
  2⤵
  - Loads dropped DLL
  PID:2732

C:\Users\Admin\AppData\Local\Temp\_MEI20602\python311.dll

Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/2732-1261-0x000007FEF6070000-0x000007FEF6658000-memory.dmp

Filesize
5.9MB

Download