b3eac493af9af76dcea70745bc294b6fbb9ffdc7c0564e341f4666af6ff153e7

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 17:05

Target

Keystrokes v1.05.exe
Size

7.9MB
MD5

5b3f3f9c2426de98004fd214b440f15c
SHA1

9f4b0384d2f6523e682a618927bdd7155fb70ffe
SHA256

b3eac493af9af76dcea70745bc294b6fbb9ffdc7c0564e341f4666af6ff153e7
SHA512

ef59f987473dc356866608499321e9b316e4f9a8f1dcfe29a4831e6d21c887cc3e424ed6a356620a82ef10ffce230380d9488beebc05deefbd46ee6c51d4cd97
SSDEEP

196608:EoiM2Hg5+iPa2BXvrRFNIPI9v40tOQveaNyDME82DUmjariDtu8:Hv2HgsiPacDfNN9lrveIUjja+D

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2972	Keystrokes v1.05.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a032-41.dat	upx
behavioral1/memory/2972-43-0x000007FEF5F90000-0x000007FEF6411000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2972	2124	Keystrokes v1.05.exe	28
PID 2124 wrote to memory of 2972	2124	Keystrokes v1.05.exe	28
PID 2124 wrote to memory of 2972	2124	Keystrokes v1.05.exe	28

C:\Users\Admin\AppData\Local\Temp\Keystrokes v1.05.exe
"C:\Users\Admin\AppData\Local\Temp\Keystrokes v1.05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\Keystrokes v1.05.exe
  "C:\Users\Admin\AppData\Local\Temp\Keystrokes v1.05.exe"
  2⤵
  - Loads dropped DLL
  PID:2972

C:\Users\Admin\AppData\Local\Temp\_MEI21242\python39.dll

Filesize
1.4MB

MD5
25c2f126b06b7b2f6188d89224c4a277

SHA1
db0a08bd014bd61f91319b19730a6647febd16ad

SHA256
f37a76eced4d25f4f652cb2e4fc7aac2592156a38652cab7e87f1e63892e6a02

SHA512
aed3321475b3437abb614c1a927a6ce337dc0507f8ade6d86d3b31642eedb6c771cd113307c7f3cc8162a9903b90e89c1513cf1e4549914cbe8d7a55bd9ad0ef

Download Submit
memory/2972-43-0x000007FEF5F90000-0x000007FEF6411000-memory.dmp

Filesize
4.5MB

Download