392525f4166157cec65b28c8fcc84212b17dbd859d50bd4f5f852c9c9c01b4c5

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 03:23

Target

Auzre_Setup.exe
Size

6.2MB
MD5

50988b63ff85acdb5956b38a05096378
SHA1

d9e14e4871218abc7144fb0d7b1a9cafd178d83e
SHA256

392525f4166157cec65b28c8fcc84212b17dbd859d50bd4f5f852c9c9c01b4c5
SHA512

6dbe20a6fb8ef33fa64b1cc266fd2468ea6f15cfac9e18f677a5a507d213b41c236107117810fcccfd65737ca538f2d1a376bf5e85e5fa9c5365bd322baf773f
SSDEEP

98304:URVEtdFBgyMAamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R1BM2h3Bs38:USFyBeN/FJMIDJf0gsAGK4R1u2M38

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Auzre_Setup.exe

pid process

2680 Auzre_Setup.exe

pid	process
2680	Auzre_Setup.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI22362\python310.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Auzre_Setup.exe

description	pid	process	target process
PID 2236 wrote to memory of 2680	2236	Auzre_Setup.exe	Auzre_Setup.exe
PID 2236 wrote to memory of 2680	2236	Auzre_Setup.exe	Auzre_Setup.exe
PID 2236 wrote to memory of 2680	2236	Auzre_Setup.exe	Auzre_Setup.exe

C:\Users\Admin\AppData\Local\Temp\Auzre_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Auzre_Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\Auzre_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Auzre_Setup.exe"
  2⤵
  - Loads dropped DLL
  PID:2680

C:\Users\Admin\AppData\Local\Temp\_MEI22362\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
memory/2680-24-0x000007FEF6350000-0x000007FEF67BE000-memory.dmp

Filesize
4.4MB

Download