55c12edaade5479133cf5f586f74f0a03d32b7c8a1066d829d229f0a0b0ff16a

Analysis

max time kernel
48s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 00:37

Target
SynsX.exe
Size 78.7MB
Sample240117-ayq8pseeb5
SHA256 55c12edaade5479133cf5f586f74f0a03d32b7c8a1066d829d229f0a0b0ff16a
MD5 1fcbbc67e3176042323a59b187e98115
SHA1 279914fea04d036e33d14b4e48be8f2fef99a2cf
SHA512 8c10eefcd5bdf373ad33bd0ee699343e9eed730115538c02786a5a2960eeeba4d0f0f80436feb21786c996d200548475aba0f84c74b682354f4bb0fc6b299bab
SSDEEP 1572864:uvlQ3j0DGSk8IpG7V+VPhqcLE7YhjC0WlsnghowmaOllpWG9OoyXBqX:uvl+TSkB05awcvhujsghfxOllpP9OjXo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2576	SynsX.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cc49-1259.dat	upx
behavioral1/memory/2576-1265-0x000007FEF5F20000-0x000007FEF6509000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2576	1996	SynsX.exe	29
PID 1996 wrote to memory of 2576	1996	SynsX.exe	29
PID 1996 wrote to memory of 2576	1996	SynsX.exe	29

C:\Users\Admin\AppData\Local\Temp\SynsX.exe
"C:\Users\Admin\AppData\Local\Temp\SynsX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\SynsX.exe
  "C:\Users\Admin\AppData\Local\Temp\SynsX.exe"
  2⤵
  - Loads dropped DLL
  PID:2576

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19962\python311.dll
Size 1.6MB
SHA256 43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76
MD5 546cc5fe76abc35fdbf92f682124e23d
SHA1 5c1030752d32aa067b49125194befee7b3ee985a
SHA512 cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720
SSDEEP 24576:HzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:v9oNizvxB3ZAEx5ONCVwXUmeTVlv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2576-1265-0x000007FEF5F20000-0x000007FEF6509000-memory.dmp

Download

memory/2576-2520-0x000007FEF5F20000-0x000007FEF6509000-memory.dmp

Download