af83f9089626a51404c25f162ae74f173fec31bcf450b13ccfa8656e850ba463

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 01:02

Target

321f4cf12473f004464aa797966517a2.exe
Size

7.4MB
MD5

321f4cf12473f004464aa797966517a2
SHA1

a3cddb8878b89c504449b7c40d039ec616f8c1c6
SHA256

af83f9089626a51404c25f162ae74f173fec31bcf450b13ccfa8656e850ba463
SHA512

622fa0a314696bdb767c541c3703b7b44650abe038024fb61773c4cb351e6867dde280460674d9fd30dc2f4592e84f458e398b3109021d079abc3918bdc55127
SSDEEP

196608:HrxU8PULjv+bhqNVoB0SEsucQZ41JBbIP11tJG:G8P0L+9qz80SJHQK1Jy1vJG

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2724	321f4cf12473f004464aa797966517a2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016d5f-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2724	2304	321f4cf12473f004464aa797966517a2.exe	28
PID 2304 wrote to memory of 2724	2304	321f4cf12473f004464aa797966517a2.exe	28
PID 2304 wrote to memory of 2724	2304	321f4cf12473f004464aa797966517a2.exe	28

C:\Users\Admin\AppData\Local\Temp\321f4cf12473f004464aa797966517a2.exe
"C:\Users\Admin\AppData\Local\Temp\321f4cf12473f004464aa797966517a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\321f4cf12473f004464aa797966517a2.exe
  "C:\Users\Admin\AppData\Local\Temp\321f4cf12473f004464aa797966517a2.exe"
  2⤵
  - Loads dropped DLL
  PID:2724

C:\Users\Admin\AppData\Local\Temp\_MEI23042\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
memory/2724-23-0x000007FEF5620000-0x000007FEF5C0E000-memory.dmp

Filesize
5.9MB

Download