17f6e0a0e7436b49256404998f53f75aeb633bc3e1189d1c3596d9c9ecea5254

Resubmissions

04/04/2024, 16:00

04/04/2024, 15:52

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 15:52

Target
FH4GDGD.exe
Size 7.4MB
Sample240404-ta2t3scd89
SHA256 17f6e0a0e7436b49256404998f53f75aeb633bc3e1189d1c3596d9c9ecea5254
MD5 1ec691396b40ec3ce65331a03a40275f
SHA1 1aa7a7d296d597eda4d67a19746f155eb7f6c7c6
SHA512 9820daa225cdb5513248f2cb08560f22718654d300d04f60cc5fa51371fde762e8fb09e11c6d0bf3630c8ffc3e27eb2bde100e66fa9d23b141384a585bf33fcd
SSDEEP 98304:Q9Mc5durErvz81LpWjjUlLkvzgXO9hAlaYrzzuJZYJ1JIuIHKU73bcgVowg/g:QLdurErvI9pWjgyvoaYrE41JIuIqoxkY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1132	FH4GDGD.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00060000000155e2-21.dat	upx
behavioral1/memory/1132-23-0x000007FEF6380000-0x000007FEF6970000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1132	2980	FH4GDGD.exe	28
PID 2980 wrote to memory of 1132	2980	FH4GDGD.exe	28
PID 2980 wrote to memory of 1132	2980	FH4GDGD.exe	28

C:\Users\Admin\AppData\Local\Temp\FH4GDGD.exe
"C:\Users\Admin\AppData\Local\Temp\FH4GDGD.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\FH4GDGD.exe
  "C:\Users\Admin\AppData\Local\Temp\FH4GDGD.exe"
  2⤵
  - Loads dropped DLL
  PID:1132

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\python311.dll
Size 1.6MB
SHA256 28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76
MD5 b167b98fc5c89d65cb1fa8df31c5de13
SHA1 3a6597007f572ea09ed233d813462e80e14c5444
SHA512 40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8
SSDEEP 24576:/JvPPQ9M/dLELzCFPObgFBJLV8FEiQvWZcUHjdhvDCmAUjJpbgsjVhmjQfrOt2xG:lP5LELznbKdMnQkcUDdlpAwS+h5qCop
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1132-23-0x000007FEF6380000-0x000007FEF6970000-memory.dmp

Download