bf1bf24d9ea04f41a0d819cf26ea74c1a2d13395dc85860e8945d20e11d2158a

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 15:07

Target

UPGRADER.exe
Size

6.9MB
MD5

94e23cdd6b08b5676c3a26ec85236966
SHA1

02af1dc4444df4ccd2d9c44ad0e5bdb5ca7ac5fe
SHA256

bf1bf24d9ea04f41a0d819cf26ea74c1a2d13395dc85860e8945d20e11d2158a
SHA512

fed3b600d45bf8447b335eecb3c8bd1e8ac33bf8efb3e4ec5a2d804e6f2fc615d90894625c0320b79113a77248d597a1923eb3b09f2109ada44ce0e0b547c181
SSDEEP

196608:grGT0cKeNTfm/pf+xk4dWRGtrbWOjgWy4:Ry/pWu4kRGtrbvMWy4

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

UPGRADER.exe

pid process

2624 UPGRADER.exe

pid	process
2624	UPGRADER.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI23522\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

UPGRADER.exe

description	pid	process	target process
PID 2352 wrote to memory of 2624	2352	UPGRADER.exe	UPGRADER.exe
PID 2352 wrote to memory of 2624	2352	UPGRADER.exe	UPGRADER.exe
PID 2352 wrote to memory of 2624	2352	UPGRADER.exe	UPGRADER.exe

C:\Users\Admin\AppData\Local\Temp\UPGRADER.exe
"C:\Users\Admin\AppData\Local\Temp\UPGRADER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Local\Temp\UPGRADER.exe
"C:\Users\Admin\AppData\Local\Temp\UPGRADER.exe"
2⤵
- Loads dropped DLL
PID:2624

C:\Users\Admin\AppData\Local\Temp\_MEI23522\python311.dll
Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
memory/2624-23-0x000007FEF61D0000-0x000007FEF67B8000-memory.dmp

Filesize
5.9MB

Download