f0d1d33813bd9b166e2a9ba12701296b37e008dc78d1e9ae9350a56aa8c90e95

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 12:22

Target

client-built.exe
Size

16.6MB
MD5

4a72d8af67304a8e1ec56174682f8877
SHA1

1f182dc59b27105facc49c5cf09c6e706e68f5db
SHA256

f0d1d33813bd9b166e2a9ba12701296b37e008dc78d1e9ae9350a56aa8c90e95
SHA512

ab5bd2a0e31bb810ec4e2e4185b41cbe227cae39ed1920d3ddd3c9e62c1c5f9c7a3242e5e318d832574571e2ecc3ee4cb38e3d91047e9320dd5d0210a7247508
SSDEEP

393216:5Kc9WLFJF575ua11nQaFqyYgsSVXGN1aJ3u88Xp:Qc9QFTllfnQR9c

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

client-built.exe

pid process

2684 client-built.exe

pid	process
2684	client-built.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI28722\python310.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

client-built.exe

description	pid	process	target process
PID 2872 wrote to memory of 2684	2872	client-built.exe	client-built.exe
PID 2872 wrote to memory of 2684	2872	client-built.exe	client-built.exe
PID 2872 wrote to memory of 2684	2872	client-built.exe	client-built.exe

C:\Users\Admin\AppData\Local\Temp\client-built.exe
"C:\Users\Admin\AppData\Local\Temp\client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Users\Admin\AppData\Local\Temp\client-built.exe
"C:\Users\Admin\AppData\Local\Temp\client-built.exe"
2⤵
- Loads dropped DLL
PID:2684

C:\Users\Admin\AppData\Local\Temp\_MEI28722\python310.dll
Filesize
1.4MB

MD5
bbcb74867bd3f8a691b1f0a394336908

SHA1
aea4b231b9f09bedcd5ce02e1962911edd4b35ad

SHA256
800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41

SHA512
00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481

Download Submit
memory/2684-115-0x000007FEF5FB0000-0x000007FEF641E000-memory.dmp

Filesize
4.4MB

Download