030b0f72c5574d764fcf322e9d740805a561647759f4aaa4b218ac74f1f33409

Analysis

max time kernel
5s
max time network
0s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:46

Target

XcHvYYrNa.exe
Size

7.4MB
MD5

725efa571ee805ad2e9625f9def4ea68
SHA1

25debef3d6d3007b7df2665cf18700a4d944e70f
SHA256

030b0f72c5574d764fcf322e9d740805a561647759f4aaa4b218ac74f1f33409
SHA512

10f4e08d57ca6ce8d4f4ba3d90891956081965d770d10be7f678e8f75e816a26f4cea5c1be9f8d3c978e261dd31ce69f225da30af6f4b4bf5b669745712f08a0
SSDEEP

196608:VrYVP9VcurErvI9pWjgfPvzm6gsFEB4AuE:wlCurEUWjC3zDb84AuE

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

XcHvYYrNa.exe

pid process

2568 XcHvYYrNa.exe

pid	process
2568	XcHvYYrNa.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI19322\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

XcHvYYrNa.exe

description	pid	process	target process
PID 1932 wrote to memory of 2568	1932	XcHvYYrNa.exe	XcHvYYrNa.exe
PID 1932 wrote to memory of 2568	1932	XcHvYYrNa.exe	XcHvYYrNa.exe
PID 1932 wrote to memory of 2568	1932	XcHvYYrNa.exe	XcHvYYrNa.exe

C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe
"C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe
"C:\Users\Admin\AppData\Local\Temp\XcHvYYrNa.exe"
2⤵
- Loads dropped DLL
PID:2568

C:\Users\Admin\AppData\Local\Temp\_MEI19322\python311.dll
Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2568-23-0x000007FEF63B0000-0x000007FEF69A2000-memory.dmp

Filesize
5.9MB

Download