1cf4d4852822a36a9c57c64e0a4a7c14c27751b448910f841e0733f586239814

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 09:52

Target

grab.exe
Size

7.5MB
MD5

553d236d2a6a0a4ca78641f9a932ecaa
SHA1

3b0354f24b67f16efd93afcb95540886ef091490
SHA256

5ec487769f184e246bef6dc014df3eed2193d22c7887b0adedc4bb69299f8cf4
SHA512

e575738994a46704f14d44b9e38b3f9b67f2d507eb7fce7ada95b6dfe5697b783137de20dc88004f5fae964ffbcd47880447d6b07c2024353c7f926054333bc6
SSDEEP

196608:FyQsJbT/9bvLz3S1bA32O5iJdYW0+S5/Ukgdv:uJbTlj3S1bO2g8c+Si5

Score

7^/10

upx

pid	process
2592	grab.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI19682\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

grab.exe

description	pid	process	target process
PID 1968 wrote to memory of 2592	1968	grab.exe	grab.exe
PID 1968 wrote to memory of 2592	1968	grab.exe	grab.exe
PID 1968 wrote to memory of 2592	1968	grab.exe	grab.exe

C:\Users\Admin\AppData\Local\Temp\grab.exe
"C:\Users\Admin\AppData\Local\Temp\grab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Users\Admin\AppData\Local\Temp\grab.exe
"C:\Users\Admin\AppData\Local\Temp\grab.exe"
2⤵
- Loads dropped DLL
PID:2592

C:\Users\Admin\AppData\Local\Temp\_MEI19682\python311.dll
Filesize
1.6MB

MD5
5792adeab1e4414e0129ce7a228eb8b8

SHA1
e9f022e687b6d88d20ee96d9509f82e916b9ee8c

SHA256
7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

SHA512
c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

Download Submit
memory/2592-27-0x000007FEF5D40000-0x000007FEF6329000-memory.dmp

Filesize
5.9MB

Download