9567a8364357429d5a63544a9ee71ad1e51ef27e567e01f51d690cac7e750e18

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 01:01

Target
Skiioh_0_delay.exe
Size 16.1MB
Sample240609-bdqbcabg82
SHA256 9567a8364357429d5a63544a9ee71ad1e51ef27e567e01f51d690cac7e750e18
MD5 4d0db91423bea25109b9e33677742df9
SHA1 d5eb9baf4fcd73721835d8e2e280ade53f11edbd
SHA512 3432abeaee492bd5c843e1e45cbf762ac399d2eb9c73939db231b325f30c72ee30a7df23bc41caec372799bdf4b5b4022eba2b53703c789a9561d22c604934ab
SSDEEP 393216:8Kc9WLFfF575ua112QaFqyYgsSVXGzQsXHNVPI:Lc9QFdllf2QR9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1952	Skiioh_0_delay.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000198c6-104.dat	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1952	Skiioh_0_delay.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1952	2872	Skiioh_0_delay.exe	28
PID 2872 wrote to memory of 1952	2872	Skiioh_0_delay.exe	28
PID 2872 wrote to memory of 1952	2872	Skiioh_0_delay.exe	28

C:\Users\Admin\AppData\Local\Temp\Skiioh_0_delay.exe
"C:\Users\Admin\AppData\Local\Temp\Skiioh_0_delay.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\Skiioh_0_delay.exe
  "C:\Users\Admin\AppData\Local\Temp\Skiioh_0_delay.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1952

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28722\python310.dll
Size 1.4MB
SHA256 800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41
MD5 bbcb74867bd3f8a691b1f0a394336908
SHA1 aea4b231b9f09bedcd5ce02e1962911edd4b35ad
SHA512 00745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481
SSDEEP 24576:Jmhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX5k:JmT0OjUK51xZ/7s6GDwKDD9OJEwsAE2c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1952-106-0x000007FEF5D40000-0x000007FEF61AE000-memory.dmp

Download

memory/1952-107-0x000007FEF5D40000-0x000007FEF61AE000-memory.dmp

Download