69a816b4d6108f18c8ea9640f305920aa144ed7098145d14e04b0b48bb2a50f5

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/02/2024, 03:31

Target
2ndsetup.exe
Size 80.9MB
Sample240209-d27xeagh58
SHA256 69a816b4d6108f18c8ea9640f305920aa144ed7098145d14e04b0b48bb2a50f5
MD5 628813281b0d12d7cb40d8bb3aa58c8b
SHA1 2c551a87ed7b8841405fdb944b8681861916260f
SHA512 472c53334481d02387bd93efec9408218bcc760f458dd47ca1d674ae76f78e6821aee246d31c9ae1b8201bb13f1681c279a878867bdad0b0032c9c6bc767e0bf
SSDEEP 1572864:/vlQ3jgSk8IpG7V+VPhqO+ydE7KjChWWB/4PcPJNWk9O10PRz8L:/vl+USkB05awO+yJuHB/YcPDH9OKPRz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2740	2ndsetup.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001ceb2-1261.dat	upx
behavioral1/memory/2740-1263-0x000007FEF57C0000-0x000007FEF5DAE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2740	1704	2ndsetup.exe	28
PID 1704 wrote to memory of 2740	1704	2ndsetup.exe	28
PID 1704 wrote to memory of 2740	1704	2ndsetup.exe	28

C:\Users\Admin\AppData\Local\Temp\2ndsetup.exe
"C:\Users\Admin\AppData\Local\Temp\2ndsetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\2ndsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\2ndsetup.exe"
  2⤵
  - Loads dropped DLL
  PID:2740

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\python311.dll
Size 1.6MB
SHA256 30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
MD5 76eb1ad615ba6600ce747bf1acde6679
SHA1 d3e1318077217372653be3947635b93df68156a4
SHA512 2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb
SSDEEP 24576:VuN7aTqO/EbieKaIaSU9SZpY84VtQZGZWlzn2mgHGaApfjYZHbTSFUtXQBWKwLdM:5Tq3xLSp8GZGZ8bqGawMIwqGC0Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2740-1263-0x000007FEF57C0000-0x000007FEF5DAE000-memory.dmp

Download