ad55d24fac5d5589bf1736d5e6c91382588c5b033028221d043ee348a1530351

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 03:00

Target
Electron V3/ElectronV3.exe
Size 19.3MB
Sample240616-dhpaysxaqa
SHA256 d969b54cbe96cf4b85769e4786950fc1ed1efcc089ae52d95f7d2e2b40fb5528
MD5 6c58afddbf1cfb6508ae8850cce5ff83
SHA1 e65d692de987d61b8e0da027ebba7fedce36388a
SHA512 4bd32e870ea38c8af1d6bc3ee3cf09c242eb5537cd69f225a6da057abf0260d08807b035648f594a6d29c407e4b6948d6478aa41244ba40a0044ccb560b0e84c
SSDEEP 196608:J5MCxCmDAJediqShxWTMRHvUWvo3hxjno/w3iFCxHQbRpXTgK/P/d:MOShATMRHdgxro/w3uCxHQbDgGN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2580	ElectronV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/files/0x0005000000019c03-46.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2580	1916	ElectronV3.exe	28
PID 1916 wrote to memory of 2580	1916	ElectronV3.exe	28
PID 1916 wrote to memory of 2580	1916	ElectronV3.exe	28

C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2580

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19162\python310.dll
Size 1.4MB
SHA256 3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e
MD5 90d5b8ba675bbb23f01048712813c746
SHA1 f2906160f9fc2fa719fea7d37e145156742ea8a7
SHA512 872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e
SSDEEP 24576:4fng8rkHg8NdzWjg0oHc47V2tioO8pxPusuwy+l6JrHqfgmCrxSyCNpsDpSZzjFx:QrQAkzWnoHc452tlpxPOi6JrqIBSyCN2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2580-48-0x000007FEF6480000-0x000007FEF68E5000-memory.dmp

Download