105f50a076dffc8cc2abafd844a23d2b77b7b8fc3c3b3388202d5681bcacc910

Resubmissions

30/09/2024, 13:45

16/05/2024, 16:11

30/01/2024, 07:25

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/01/2024, 07:25

Target

SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe
Size

10.7MB
MD5

5bf290d7209f17eaee7d8548beaf29f6
SHA1

fe6d790f22643fc139ac5a53cadc5554a855bdd4
SHA256

105f50a076dffc8cc2abafd844a23d2b77b7b8fc3c3b3388202d5681bcacc910
SHA512

ee79716c0bc2a0defc20f79a8dcdc67d0607083bc5c2bd9bb53e37fa91faebbb313600d721cde2f932d7498a316b4cf4ce3c89b83202009f52242e1b6725abc5
SSDEEP

196608:iPLd8eOaPAEu9on3dDTeeNy+wfm/pf+xfdkReBnfXWKsnPtSDrIWOIWsDaqkH:YLdXeD9et5y+9/pWFGRUnfXBsnYDrIW6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2012	SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018675-46.dat	upx
behavioral1/files/0x0005000000018675-47.dat	upx
behavioral1/memory/2012-48-0x000007FEF5940000-0x000007FEF5F28000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2012	816	SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe	28
PID 816 wrote to memory of 2012	816	SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe	28
PID 816 wrote to memory of 2012	816	SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.20285.22431.exe"
  2⤵
  - Loads dropped DLL
  PID:2012

C:\Users\Admin\AppData\Local\Temp\_MEI8162\python311.dll

Filesize
624KB

MD5
cf6e64d89afd5c34e14310e0142af374

SHA1
b803aca65b364dc724e3d5cb607bdbe0933f26ce

SHA256
2a687988e5afce3eaefa9a855bc8f740c1f989caea5e95a2f3eebc711363d15b

SHA512
e88a2bf760ce3307be8031a19906ead62a6c905802198590752f6145f3a4d2eb66eab4729c9f443c48fbabea71272f7bb0e8f896b527bac6f4513e3226e3b55f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI8162\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
memory/2012-48-0x000007FEF5940000-0x000007FEF5F28000-memory.dmp

Filesize
5.9MB

Download