70f79e08ffce3875dfd6d01a55f71f0735bed751967dc551ec670347a1b342cf

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 22:24

Target

Duper.exe
Size

7.5MB
MD5

dbe88d16efc88646a419dff70619b1af
SHA1

79603b1414bdf176da7729eaa2c4e8686171c275
SHA256

70f79e08ffce3875dfd6d01a55f71f0735bed751967dc551ec670347a1b342cf
SHA512

e6a63102cd8f936fd25337aaa243c6b53ffaa8817866e476e7c5209a532e09572c3bf1f7fc37446897d124a644f287143cfd9fc4d1c9f1cb582359f181733597
SSDEEP

196608:sYiEzoLjv+bhqNVoB8Ck5c7GpNlpn41J2+bk9qtlDfJ6:KDL+9qz88Ck+7q3p41J8qfI

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2756	Duper.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000015d5d-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2756	2880	Duper.exe	28
PID 2880 wrote to memory of 2756	2880	Duper.exe	28
PID 2880 wrote to memory of 2756	2880	Duper.exe	28

C:\Users\Admin\AppData\Local\Temp\Duper.exe
"C:\Users\Admin\AppData\Local\Temp\Duper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\Duper.exe
  "C:\Users\Admin\AppData\Local\Temp\Duper.exe"
  2⤵
  - Loads dropped DLL
  PID:2756

C:\Users\Admin\AppData\Local\Temp\_MEI28802\python312.dll

Filesize
1.8MB

MD5
2f1072ddd9a88629205e7434ed055b3e

SHA1
20da3188dabe3d5fa33b46bfe671e713e6fa3056

SHA256
d086257a6b36047f35202266c8eb8c1225163bd96b064d31b80f0dbe13da2acf

SHA512
d8dddc30733811ed9a9c4ae83ac8f3fc4d8ba3fa8051d95242fbd432fd5bf24122373ac5eea9fec78f0daf7c1133365f519a13cf3f105636da74820a00a25e9b

Download Submit
memory/2756-23-0x000007FEF5990000-0x000007FEF6068000-memory.dmp

Filesize
6.8MB

Download