307b1acd876c7303ee86290b36a1cd35a4cd074671bcff4dbaff8e7d4ecbffcf

Resubmissions

11/05/2024, 16:54

11/05/2024, 16:45

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:54

Target

sigmaratexecv3.exe
Size

15.8MB
MD5

278f86bfca38365b29120354f3c2884f
SHA1

9a3d76f6775d082ce5907503e12c9810e79f10a7
SHA256

307b1acd876c7303ee86290b36a1cd35a4cd074671bcff4dbaff8e7d4ecbffcf
SHA512

072cc4e72a564ad2543d1fafcdf824b7086c6020f661aafc58f26b78620a1d211b09af94da53e1ae8471ad73a92774e69877d3da974ae5ef8faba70838ee1854
SSDEEP

393216:9o9Ddnnx89uxfQ5L1V8dkurEUWjPCEhM1tkRmyV+da:i9ZnxGuWRndbqh16Rm4+da

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2836	sigmaratexecv3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a457-95.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2836	1500	sigmaratexecv3.exe	28
PID 1500 wrote to memory of 2836	1500	sigmaratexecv3.exe	28
PID 1500 wrote to memory of 2836	1500	sigmaratexecv3.exe	28

C:\Users\Admin\AppData\Local\Temp\sigmaratexecv3.exe
"C:\Users\Admin\AppData\Local\Temp\sigmaratexecv3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\sigmaratexecv3.exe
  "C:\Users\Admin\AppData\Local\Temp\sigmaratexecv3.exe"
  2⤵
  - Loads dropped DLL
  PID:2836

C:\Users\Admin\AppData\Local\Temp\_MEI15002\python312.dll

Filesize
1.8MB

MD5
cbd02b4c0cf69e5609c77dfd13fba7c4

SHA1
a3c8f6bfd7ffe0783157e41538b3955519f1e695

SHA256
ecef0ed97c7b249af3c56cde0bfcae70f66530d716b48b5d94621c3dba8236b5

SHA512
a3760ecaa9736eb24370a0a20dd22a1ee53b3f8002195947bc7d21b239278ec8e26bcc131d0132c530767d1de59954be7946dcf54fcbf2584052c9d9a5615567

Download Submit
memory/2836-97-0x000007FEF6210000-0x000007FEF68E9000-memory.dmp

Filesize
6.8MB

Download