00a1d4c5aed5320d9d225b4f23b567dec0b6a208ae0114150f6d8209be2fd252

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 17:23

Target

Electron V3/ElectronV3.exe
Size

24.3MB
MD5

e891973adb4e3a6edc9738b84e382be1
SHA1

bab0eb519e90590a96599a52d14acf9041bcad2e
SHA256

0e3daf09ae8042d432ce7aff2544762024590ac89bd6753f27fbf9fdce478b7f
SHA512

4db3ac8856479698ab9513576d008d54f111355f437299f3b7254d8e70db5228e2d9f3cd7318c578f27009493539663c56a889647bb1de9c35ebb2e7c71713f9
SSDEEP

196608:tO6xCmDAJediqShxWTMRHvUWvo3hxjno/w3iFCxHQbRpXpPr+5Py:cmShATMRHdgxro/w3uCxHQbZPY

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2692	ElectronV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019251-46.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2692	1636	ElectronV3.exe	28
PID 1636 wrote to memory of 2692	1636	ElectronV3.exe	28
PID 1636 wrote to memory of 2692	1636	ElectronV3.exe	28

C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2692

C:\Users\Admin\AppData\Local\Temp\_MEI16362\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2692-48-0x000007FEF6200000-0x000007FEF6665000-memory.dmp

Filesize
4.4MB

Download