c00577f59d3fded606cdc5702900b69add09153dd1d61766f2e18720641fb384

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 21:43

Target

source_prepared.exe
Size

80.4MB
MD5

6d8d416dcf396e294a27d5d7977ca1a7
SHA1

51adb4a627cf007c1c2d406fd3828cceab903d9c
SHA256

c00577f59d3fded606cdc5702900b69add09153dd1d61766f2e18720641fb384
SHA512

473cd5032679a0dbea6373c91c04e6d87f654eccdf881de0c373f352b43d78af5182639d8fe82f2658a176e374803a61ed32974d7c0c8432eb067f9b86961f38
SSDEEP

1572864:DvlQ3j0gJSk8IpG7V+VPhqcPE70jC0WB/4PcPJTWB9bDDP1qA:Dvl+tJSkB05awcVujB/YcPZU9bvP1q

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2736	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cc09-1259.dat	upx
behavioral1/memory/2736-1261-0x000007FEF5BD0000-0x000007FEF61B9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2736	1836	source_prepared.exe	28
PID 1836 wrote to memory of 2736	1836	source_prepared.exe	28
PID 1836 wrote to memory of 2736	1836	source_prepared.exe	28

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2736

C:\Users\Admin\AppData\Local\Temp\_MEI18362\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/2736-1261-0x000007FEF5BD0000-0x000007FEF61B9000-memory.dmp

Filesize
5.9MB

Download