4910f58c9a2ba49f9bead07d6fbaeb96f9f21a891e45f9b7a17a8aa38ef93c5f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 19:17

Target

1.exe
Size

23.6MB
MD5

95615082a87c8b2be969ff4dc2ab73dd
SHA1

4bf1a82096989c88081c12b885f817f61cf01806
SHA256

4910f58c9a2ba49f9bead07d6fbaeb96f9f21a891e45f9b7a17a8aa38ef93c5f
SHA512

db6e9ea414d0900a438cf582a7706fae447fee50b80b49daa6c3e4b17b29a1244d9bc272086fec6eac51300c98d46508c251db0d99953b89b7dcda74edbbcabf
SSDEEP

393216:VW/PWTF9TDhrrqL0gZkoxQujmBZ41d+uz2Dr4RxV6oS0jbId1Twsm+lT/Fqyf0gR:VW/PWTFj+Rt181ERxX1jb8tT4v07

Score

7^/10

upx

pid	process
2640	1.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI22802\python310.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1.exe

description	pid	process	target process
PID 2280 wrote to memory of 2640	2280	1.exe	1.exe
PID 2280 wrote to memory of 2640	2280	1.exe	1.exe
PID 2280 wrote to memory of 2640	2280	1.exe	1.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
2⤵
- Loads dropped DLL
PID:2640

C:\Users\Admin\AppData\Local\Temp\_MEI22802\python310.dll
Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
memory/2640-24-0x000007FEF6300000-0x000007FEF676E000-memory.dmp

Filesize
4.4MB

Download