d23acf9b80b8e55860bbf782989ca483f3e90ab6d16530b3078c1aa533c04164

Resubmissions

27-05-2024 00:39

27-05-2024 00:38

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 00:39

Target

ImageLogger.exe
Size

76.4MB
MD5

c670c67a1991703cc8d23899c6cc5dfd
SHA1

ebbe19b62f3a012b6db6fcb98da518609c9ad916
SHA256

d23acf9b80b8e55860bbf782989ca483f3e90ab6d16530b3078c1aa533c04164
SHA512

6fb4cd3406059c6eec1983c1848be20d6794c22b9f0742ddcf269860cb7a1e7520be695bdaca7421696ad8adadb1af988e8797becf836a2f37f9d3ff5c0f661b
SSDEEP

1572864:/viEZjFjESk8IpG7V+VPhqYdfME7mjx6iYweyJulZUdgu0WVKj9egOqZ9U3:/vZZWSkB05awcfQtnpuK0c2j9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

ImageLogger.exe

pid process

2596 ImageLogger.exe

pid	process
2596	ImageLogger.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI19362\python312.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ImageLogger.exe

description	pid	process	target process
PID 1936 wrote to memory of 2596	1936	ImageLogger.exe	ImageLogger.exe
PID 1936 wrote to memory of 2596	1936	ImageLogger.exe	ImageLogger.exe
PID 1936 wrote to memory of 2596	1936	ImageLogger.exe	ImageLogger.exe

C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe
"C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe
  "C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"
  2⤵
  - Loads dropped DLL
  PID:2596

C:\Users\Admin\AppData\Local\Temp\_MEI19362\python312.dll

Filesize
1.7MB

MD5
73ecc8d4decf6f198d6505bde482e37a

SHA1
ed30f5bd628b4a5de079062ea9b909b99807021c

SHA256
b598545be6c99f7db852a510768ecf80ed353fad3989af342bc6faf66fd64648

SHA512
56923c477d35680aed73980e0404768f841da868ca11f39888caff0fc06f4ae906551b4bd47f98dda2cc2d81ea9eed17fa7c17aa59d4d7c37510ba24d7ac5976

Download Submit
memory/2596-1254-0x000007FEF5AA0000-0x000007FEF6165000-memory.dmp

Filesize
6.8MB

Download