516855762658e69cf4a45d7cbdd97d0e58523512724c790c5b8fc39ff426d1ef

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 01:14

Target

WareHub/WareHubV2/warehubv2.exe
Size

5.9MB
MD5

63dfd195052cb622d1936a675350f5cc
SHA1

5eba39ca7497e7cfc13eb0ab51a09b36769c189e
SHA256

6f4c319f20df53ea945cba7a54e4e348c3348ccdec96434bd6b4111cd28a9efc
SHA512

befeaee2b443aa89e6b9c0a0ccf846d7fff723d71c6a4577238ad13598a1eae34feaac31c0e43c079bfc7c7483207797d7f4a1dfe1c1fab745661588bc6c4006
SSDEEP

98304:61+moDUN43WhjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6akOo3AKo:61+umWdOjmFwDRxtYSHdK34kdai7bN3u

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1840	warehubv2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000015c6b-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1840	2340	warehubv2.exe	29
PID 2340 wrote to memory of 1840	2340	warehubv2.exe	29
PID 2340 wrote to memory of 1840	2340	warehubv2.exe	29

C:\Users\Admin\AppData\Local\Temp\WareHub\WareHubV2\warehubv2.exe
"C:\Users\Admin\AppData\Local\Temp\WareHub\WareHubV2\warehubv2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\WareHub\WareHubV2\warehubv2.exe
  "C:\Users\Admin\AppData\Local\Temp\WareHub\WareHubV2\warehubv2.exe"
  2⤵
  - Loads dropped DLL
  PID:1840

C:\Users\Admin\AppData\Local\Temp\_MEI23402\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/1840-28-0x000007FEF6120000-0x000007FEF6586000-memory.dmp

Filesize
4.4MB

Download
memory/1840-44-0x000007FEF6120000-0x000007FEF6586000-memory.dmp

Filesize
4.4MB

Download