fccf2be42bab41f3d1f8bb7778765729cdf5ed10a0bd65871ba3bd2b827c2402

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 22:51

Target

main.exe
Size

36.9MB
MD5

4ce7dec7f0af15277eec727a9e20142e
SHA1

5bae148e9a1865370d25d805439e60f057806a04
SHA256

fccf2be42bab41f3d1f8bb7778765729cdf5ed10a0bd65871ba3bd2b827c2402
SHA512

123fac8db9b2fea104fed3c57e304402bf1c02dbf1f19046f67ecadab67ed95af71ee8661e9d7b7b87a5b0cf092fa65fddc206d3557ada0b876ac00e6b2185b5
SSDEEP

786432:xRaNrdmuVZJW4j1B6O7WfE1StERPeJSu/6jsdbOr4q:xR0rEuTJWSfbyfEItERPeguAsd

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1636	main.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000600000001489f-12.dat	upx
behavioral1/memory/1636-14-0x000007FEF5650000-0x000007FEF5C42000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1636	1916	main.exe	28
PID 1916 wrote to memory of 1636	1916	main.exe	28
PID 1916 wrote to memory of 1636	1916	main.exe	28

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  PID:1636

C:\Users\Admin\AppData\Local\Temp\_MEI19162\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/1636-14-0x000007FEF5650000-0x000007FEF5C42000-memory.dmp

Filesize
5.9MB

Download