ad55d24fac5d5589bf1736d5e6c91382588c5b033028221d043ee348a1530351

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 03:00

Target

Electron V3/ElectronV3.exe
Size

19.3MB
MD5

6c58afddbf1cfb6508ae8850cce5ff83
SHA1

e65d692de987d61b8e0da027ebba7fedce36388a
SHA256

d969b54cbe96cf4b85769e4786950fc1ed1efcc089ae52d95f7d2e2b40fb5528
SHA512

4bd32e870ea38c8af1d6bc3ee3cf09c242eb5537cd69f225a6da057abf0260d08807b035648f594a6d29c407e4b6948d6478aa41244ba40a0044ccb560b0e84c
SSDEEP

196608:J5MCxCmDAJediqShxWTMRHvUWvo3hxjno/w3iFCxHQbRpXTgK/P/d:MOShATMRHdgxro/w3uCxHQbDgGN

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2580	ElectronV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/files/0x0005000000019c03-46.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2580	1916	ElectronV3.exe	28
PID 1916 wrote to memory of 2580	1916	ElectronV3.exe	28
PID 1916 wrote to memory of 2580	1916	ElectronV3.exe	28

C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\Electron V3\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2580

C:\Users\Admin\AppData\Local\Temp\_MEI19162\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2580-48-0x000007FEF6480000-0x000007FEF68E5000-memory.dmp

Filesize
4.4MB

Download