a2455833a9d6b07ee49110c4f447eeaf1b2c1b1274bfa70db7f43be83390d4bf

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 19:29

Target

grabber.exe
Size

52.9MB
MD5

a21756855f2e160310c08213d984da75
SHA1

e4f9ed21d416ffff1c8d6aecbbb65f17eda548a2
SHA256

a2455833a9d6b07ee49110c4f447eeaf1b2c1b1274bfa70db7f43be83390d4bf
SHA512

2033de4c88b78a488f24550a5f51fcac1466b779b16e9e23dcd2c5501ce59c95bac99482d593349bf74847ac9787bfb6d37080aedf59f974f848ee414d830b7b
SSDEEP

1572864:hS0NHnqf3Gd6xdnj+YV5szudxE7fzqrBAS:hSInyo6VVBce

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1664	grabber.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000300000002084c-706.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1664	1252	grabber.exe	28
PID 1252 wrote to memory of 1664	1252	grabber.exe	28
PID 1252 wrote to memory of 1664	1252	grabber.exe	28

C:\Users\Admin\AppData\Local\Temp\grabber.exe
"C:\Users\Admin\AppData\Local\Temp\grabber.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\grabber.exe
  "C:\Users\Admin\AppData\Local\Temp\grabber.exe"
  2⤵
  - Loads dropped DLL
  PID:1664

C:\Users\Admin\AppData\Local\Temp\_MEI12522\python312.dll

Filesize
1.7MB

MD5
7ef625a8207c1a1a46cb084dfc747376

SHA1
8cc35164b7cda0ed43eb07fdb1ea62c23ae1b6f9

SHA256
c49c511fa244815cc1ab62a4dab0a4a0ffc0a1b99ac9333f60a3f795b99f65ed

SHA512
0872033ee3dc46066db3a44693d3802b5d158ef9e0481d1e33275934800cea6a79870ac0776a85f113daa67d9629b6d8bc67cea3d2a99445114140de1c29e5a4

Download Submit
memory/1664-708-0x000007FEF5800000-0x000007FEF5EC5000-memory.dmp

Filesize
6.8MB

Download