a92cc0b1c37652001b3e33d633a026340a9565a99bf65353bbc072e7315c8cf5

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 15:53

Target

Veternal.exe
Size

6.8MB
MD5

8ea5ca15fbcf5d4576c9de70378d7162
SHA1

cb4afd26fbee5f3917d0aa5d27ba4c2da93cdd89
SHA256

a92cc0b1c37652001b3e33d633a026340a9565a99bf65353bbc072e7315c8cf5
SHA512

4760e8c4f6a3345c87980137355f79a48f47183a04920e46307554e26a6f2a6208995db2f4872a86e69774696a2fd1d5616483d9867435af08d205a2f6e10dcb
SSDEEP

196608:SODV1OB6ylnlPzf+JiJCsmFMvon6hVvvJo:32BRlnlPSa7mmvo+Jo

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2908	Veternal.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016d60-21.dat	upx
behavioral1/memory/2908-23-0x000007FEF6210000-0x000007FEF67FA000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2908	2484	Veternal.exe	28
PID 2484 wrote to memory of 2908	2484	Veternal.exe	28
PID 2484 wrote to memory of 2908	2484	Veternal.exe	28

C:\Users\Admin\AppData\Local\Temp\Veternal.exe
"C:\Users\Admin\AppData\Local\Temp\Veternal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\Veternal.exe
  "C:\Users\Admin\AppData\Local\Temp\Veternal.exe"
  2⤵
  - Loads dropped DLL
  PID:2908

C:\Users\Admin\AppData\Local\Temp\_MEI24842\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2908-23-0x000007FEF6210000-0x000007FEF67FA000-memory.dmp

Filesize
5.9MB

Download