66f7611189011141caabf58a2bb4e68af550c982111a94d867a577bc718f8045

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 01:15

Target

b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe
Size

6.9MB
MD5

26a8bb47cefbd6bab1cb10c5108f4b67
SHA1

88fc651574d643e129342afbf3f6d5794963dbff
SHA256

b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b
SHA512

0ef1927973273a33c4847966945e396735bb373cb902e6f327ea7cb10573f9d99393b1efddf67d16adc55d4809f7efa03bfb3b4f6018d53e3234e3d2d099cfaf
SSDEEP

98304:lRazHqdVfB2FS27wGcyuT/9vUIdD9C+z3zO917vOTh+ezDNh7ovmJ1nmOBN9n4mR:lAQsNcbT/9bvLz3S1bA3zNn97zJV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2708	b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016f6f-21.dat	upx
behavioral1/files/0x0006000000016f6f-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2708	2128	b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe	28
PID 2128 wrote to memory of 2708	2128	b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe	28
PID 2128 wrote to memory of 2708	2128	b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe	28

C:\Users\Admin\AppData\Local\Temp\b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe
"C:\Users\Admin\AppData\Local\Temp\b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe
  "C:\Users\Admin\AppData\Local\Temp\b40646dab0f16b4195241dc0784cf32a2c08039c3abce3262c12a51e707c5b6b.exe"
  2⤵
  - Loads dropped DLL
  PID:2708

C:\Users\Admin\AppData\Local\Temp\_MEI21282\python311.dll

Filesize
1.0MB

MD5
6c835d31757ff8fdefce7af550693e84

SHA1
1b562c1026e80532013e3cfb2b7b34b0e6c036cb

SHA256
f4794c8982fff30346216fc74c1a64730788a69f3d1d26aa514ace579a237b31

SHA512
9d51e8f2d2225f45719c863d26b7763f6e6aca1903809b459af01eaf1afef507ee9f5902712b73d0fd4e543140788ba252476b900ce7115b0acdc2a9f6552bb1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21282\python311.dll

Filesize
1024KB

MD5
cc00fb5fae1c27048cc7b1705a5f54f2

SHA1
4b875a36a28bcc03f77eb9c32d8d6324f9c31539

SHA256
f57cd6b9cf3628b8616cbfd55b9d3654bd3351cb6c1a0584bd54a62cb8540818

SHA512
455bd84190e4a484f2875485325780d9e817fe6df64e6aee5d8790353c13f354c7966d514208771c36d134dd55d1538984f4d99e638d3715fd1c65e04382a40e

Download Submit
memory/2708-23-0x000007FEF58B0000-0x000007FEF5E99000-memory.dmp

Filesize
5.9MB

Download