707df1515ab62e28470f1999946e7483abb5a41a4f5ac165871f56c47dc6b6a6

Analysis

max time kernel
7s
max time network
1s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 15:40

Target

HorizionXbetaFIX.exe
Size

30.0MB
MD5

e3e408b7aaf6e1b6e41e4725ee03ec76
SHA1

34f9797389b574ddef7373770795f5f001e63263
SHA256

707df1515ab62e28470f1999946e7483abb5a41a4f5ac165871f56c47dc6b6a6
SHA512

6e905cf221184826cbcd44a7c2b20550662437c7fdea5566dddab24f48319fe086d6054d84824fae00f68ba18c3e00cef90ed942c2aacd698895348388094cd3
SSDEEP

393216:tv9zcQq08AUh2Jp5MPL+9qzTqSJHU1JfjJ+7j6dpdkqYv1:p9gQwhZ+9qHqSJHU1xj2q0qE

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

HorizionXbetaFIX.exe

pid process

2732 HorizionXbetaFIX.exe

pid	process
2732	HorizionXbetaFIX.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI30482\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

HorizionXbetaFIX.exe

description	pid	process	target process
PID 3048 wrote to memory of 2732	3048	HorizionXbetaFIX.exe	HorizionXbetaFIX.exe
PID 3048 wrote to memory of 2732	3048	HorizionXbetaFIX.exe	HorizionXbetaFIX.exe
PID 3048 wrote to memory of 2732	3048	HorizionXbetaFIX.exe	HorizionXbetaFIX.exe

C:\Users\Admin\AppData\Local\Temp\HorizionXbetaFIX.exe
"C:\Users\Admin\AppData\Local\Temp\HorizionXbetaFIX.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Local\Temp\HorizionXbetaFIX.exe
"C:\Users\Admin\AppData\Local\Temp\HorizionXbetaFIX.exe"
2⤵
- Loads dropped DLL
PID:2732

C:\Users\Admin\AppData\Local\Temp\_MEI30482\python311.dll
Filesize
1.6MB

MD5
ca0b6b8ffcfdcd50d1909a1e67d63ab5

SHA1
62f455a3cab3bbfd6f66b6280ed3b115721fe376

SHA256
40ff47b055e386f5791d76e1f7ea14b9ad2697cdc99bc027284105822d9bac5a

SHA512
52d9f163a4fb26e5ab42983c50556f4cba4bc591f0ad7b75f74f5aac38e047625a2e66233d9e1e49d0f15ab5515d82c39236f4d4e3648c0daac16c70cf597f11

Download Submit
memory/2732-105-0x000007FEF6290000-0x000007FEF687E000-memory.dmp

Filesize
5.9MB

Download