5aebc3c056c74b9ce0b413000bc91f54ce98dec4c22aba04139dcf793baac095

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:33

Target

24994fb0806628d7fadb47fcbbc4d40b.exe
Size

6.9MB
MD5

24994fb0806628d7fadb47fcbbc4d40b
SHA1

cd2e0e5481cc3e5c34674579ebb4f2725c9dec9b
SHA256

5aebc3c056c74b9ce0b413000bc91f54ce98dec4c22aba04139dcf793baac095
SHA512

e06b4af71fed1dcc6045091f209ed37b6fbe7856c613e3b8e115df2d7bb9ebdde7164bb27b42697735fcd406a4a242f1754bcb5b229170983c0475426836fc8a
SSDEEP

196608:lPiCsXDjDyf6L2WliXYrHW1nb+19uru/KzLV1R:lPiCEDVL2ciIrHW9C6CYp

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2772	24994fb0806628d7fadb47fcbbc4d40b.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2404-7-0x000000013F570000-0x000000013F5CB000-memory.dmp	upx
behavioral1/memory/2772-29-0x000000013F570000-0x000000013F5CB000-memory.dmp	upx
behavioral1/memory/2772-31-0x000000013F570000-0x000000013F5CB000-memory.dmp	upx
behavioral1/memory/2404-57-0x000000013F570000-0x000000013F5CB000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2772	2404	24994fb0806628d7fadb47fcbbc4d40b.exe	15
PID 2404 wrote to memory of 2772	2404	24994fb0806628d7fadb47fcbbc4d40b.exe	15
PID 2404 wrote to memory of 2772	2404	24994fb0806628d7fadb47fcbbc4d40b.exe	15

C:\Users\Admin\AppData\Local\Temp\24994fb0806628d7fadb47fcbbc4d40b.exe
"C:\Users\Admin\AppData\Local\Temp\24994fb0806628d7fadb47fcbbc4d40b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\24994fb0806628d7fadb47fcbbc4d40b.exe
  "C:\Users\Admin\AppData\Local\Temp\24994fb0806628d7fadb47fcbbc4d40b.exe"
  2⤵
  - Loads dropped DLL
  PID:2772

C:\Users\Admin\AppData\Local\Temp\_MEI24042\python39.dll

Filesize
92KB

MD5
c6cf11f9f09a39368800e0fe9fd4f70f

SHA1
503c7127f7ea6704e5f7b5e0605fe313d5e9afc7

SHA256
de1fa14cedae27bb3ec9a1f94b3bbde6a377bdf9b9c98d5b893dbd60215a1622

SHA512
ef2e7b0679c217bb47c6b8d4225be44620ba3fe4ae95381326b2102ff42ad9ba1da2d3ab24564fe9e9474d64410cac29ffbc114460917ff329a0d147c892004e

Download Submit
memory/2404-7-0x000000013F570000-0x000000013F5CB000-memory.dmp

Filesize
364KB

Download
memory/2404-28-0x0000000001C30000-0x0000000001C8B000-memory.dmp

Filesize
364KB

Download
memory/2404-57-0x000000013F570000-0x000000013F5CB000-memory.dmp

Filesize
364KB

Download
memory/2772-29-0x000000013F570000-0x000000013F5CB000-memory.dmp

Filesize
364KB

Download
memory/2772-31-0x000000013F570000-0x000000013F5CB000-memory.dmp

Filesize
364KB

Download