a318c71398f37947c412373711d66a5441f07da7b9079fd54fff6ed6b8bc717a

Analysis

max time kernel
35s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 14:44

Target

Rifi_Loader.exe
Size

80.5MB
MD5

79d160860a8f2cdd113fbc03495c8462
SHA1

c237d2d9e65411b8c0bac39fa37dbac4dad21051
SHA256

a318c71398f37947c412373711d66a5441f07da7b9079fd54fff6ed6b8bc717a
SHA512

0cd0e27d93c3c137fb30c8efa8e68baf654d49a44615c727e21e22b1f988cfd235f5cce0b3c316659137c739d519d5d0ea31c3c94d8e3199c26cbf89d04592d6
SSDEEP

1572864:OvlQ3j0+JSk8IpG7V+VPhqcPE70jC0WB/4PcPJTWY9bDDP1qA:Ovl+bJSkB05awcVujB/YcPZp9bvP1q

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2696	Rifi_Loader.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cb7d-1261.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2696	2360	Rifi_Loader.exe	28
PID 2360 wrote to memory of 2696	2360	Rifi_Loader.exe	28
PID 2360 wrote to memory of 2696	2360	Rifi_Loader.exe	28

C:\Users\Admin\AppData\Local\Temp\Rifi_Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Rifi_Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\Rifi_Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Rifi_Loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2696

C:\Users\Admin\AppData\Local\Temp\_MEI23602\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/2696-1263-0x000007FEF5280000-0x000007FEF5869000-memory.dmp

Filesize
5.9MB

Download