b78a86254b0752ed6cf71762e076d66209521ab81544bddac07129ae11a6ab3d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 12:00

Target

mass_report_script.exe
Size

24.8MB
MD5

0a3dc00e485234149ddb7faac2e32889
SHA1

dc911b14a639e139dae9f58e9e89c9f1a79e11af
SHA256

b78a86254b0752ed6cf71762e076d66209521ab81544bddac07129ae11a6ab3d
SHA512

6d0130c1104a0e01fe82aaca0ddfa6c015cc9749944d1cf544b567707e7d762a99af05ba327e07c11730b2e1be7408a3ff307b681106580bc004051b9efa123e
SSDEEP

393216:7PjV5L1V8dvvX+9/pWFGRiBsnOrIWeRaDH:7PjLROvX+9/pWHGhRq

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

mass_report_script.exe

pid process

3020 mass_report_script.exe

pid	process
3020	mass_report_script.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI20682\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

mass_report_script.exe

description	pid	process	target process
PID 2068 wrote to memory of 3020	2068	mass_report_script.exe	mass_report_script.exe
PID 2068 wrote to memory of 3020	2068	mass_report_script.exe	mass_report_script.exe
PID 2068 wrote to memory of 3020	2068	mass_report_script.exe	mass_report_script.exe

C:\Users\Admin\AppData\Local\Temp\mass_report_script.exe
"C:\Users\Admin\AppData\Local\Temp\mass_report_script.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Users\Admin\AppData\Local\Temp\mass_report_script.exe
"C:\Users\Admin\AppData\Local\Temp\mass_report_script.exe"
2⤵
- Loads dropped DLL
PID:3020

C:\Users\Admin\AppData\Local\Temp\_MEI20682\python311.dll
Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
memory/3020-48-0x000007FEF5BC0000-0x000007FEF61A8000-memory.dmp

Filesize
5.9MB

Download