5d23112a6aba854805c9413bedffc90d084ca180f5535f622dd481d3530e5f59

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 01:07

Target

204b660d3be6b8c0339b96dd6ee86e60.exe
Size

17.7MB
MD5

204b660d3be6b8c0339b96dd6ee86e60
SHA1

c28798f456439f86ae7d84919dd7dcedf6bb98fa
SHA256

5d23112a6aba854805c9413bedffc90d084ca180f5535f622dd481d3530e5f59
SHA512

c8c0a358ba5f57d52818c6c4047c3eabb29ead8d1ad190041f5c34e32e2608a642707557d0ef0921a1f20a78ae9ab5fcc82d4139229f32a6fc5771fc7ea76d55
SSDEEP

393216:CqPnLFXlrSQ8DOETgsvfGF3gePuiEvE75RGE8W6q:HPLFXNSQhEI/P77t82

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3008	204b660d3be6b8c0339b96dd6ee86e60.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a09e-111.dat	upx
behavioral1/files/0x000500000001a09e-112.dat	upx
behavioral1/memory/3008-113-0x000007FEF5E00000-0x000007FEF626E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3008	2956	204b660d3be6b8c0339b96dd6ee86e60.exe	28
PID 2956 wrote to memory of 3008	2956	204b660d3be6b8c0339b96dd6ee86e60.exe	28
PID 2956 wrote to memory of 3008	2956	204b660d3be6b8c0339b96dd6ee86e60.exe	28

C:\Users\Admin\AppData\Local\Temp\204b660d3be6b8c0339b96dd6ee86e60.exe
"C:\Users\Admin\AppData\Local\Temp\204b660d3be6b8c0339b96dd6ee86e60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\204b660d3be6b8c0339b96dd6ee86e60.exe
  "C:\Users\Admin\AppData\Local\Temp\204b660d3be6b8c0339b96dd6ee86e60.exe"
  2⤵
  - Loads dropped DLL
  PID:3008

C:\Users\Admin\AppData\Local\Temp\_MEI29562\python310.dll

Filesize
55KB

MD5
9e4d074f213abdfd86cd786ba2d06ef8

SHA1
2dec895275d06e89e3aaf51ecd7c52e386d27363

SHA256
eb221f4c46ea0494400656ee08557d8a641d43923d06752d3f1f6466a0292fba

SHA512
0de1c330de62a2d064d68cbc5278a26fd7faf49f01cffda36ec85cf3bfb0ac38afe79eaba535371ec57943e7ff8a9f1dccbd46ddba3caf83b8d1072b5472f810

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI29562\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
memory/3008-113-0x000007FEF5E00000-0x000007FEF626E000-memory.dmp

Filesize
4.4MB

Download