bccfea0aa1f93962c5e794076f9a1da37fa67114cf88809a3f65f6ae8bb44655

Analysis

max time kernel
1561s
max time network
1562s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 21:23

Target

FNknoxV1.exe
Size

7.0MB
MD5

127d96c8d795e8420ee8e1e178b6dfe9
SHA1

e8db8d8577ac74a60de1afb5350b63fa8e49d045
SHA256

2ecbcb10d1027d3c8b3288d6d73010163631e3f578fe0d3ab996400dd9474e06
SHA512

f98eb6fdb763b0ab062a4a3f1d2a17fade1fd8e937bbd34f2c3fed8bd50de1dae57f75c0c67b533b09d6e86cf35fcc0bf8a6755103f0a76dcc7ea63f315acbe1
SSDEEP

98304:OwzdbM+Q2y+aq0AANDhjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbiEJ1nL2hBnP:OGf0AKpOjmFQR4MVGFtwLPsnL2hV/H

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2916	FNknoxV1.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x0006000000015c9f-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2916	2348	FNknoxV1.exe	28
PID 2348 wrote to memory of 2916	2348	FNknoxV1.exe	28
PID 2348 wrote to memory of 2916	2348	FNknoxV1.exe	28

C:\Users\Admin\AppData\Local\Temp\FNknoxV1.exe
"C:\Users\Admin\AppData\Local\Temp\FNknoxV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\FNknoxV1.exe
  "C:\Users\Admin\AppData\Local\Temp\FNknoxV1.exe"
  2⤵
  - Loads dropped DLL
  PID:2916

C:\Users\Admin\AppData\Local\Temp\_MEI23482\python311.dll

Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
memory/2916-24-0x000007FEF5FA0000-0x000007FEF6589000-memory.dmp

Filesize
5.9MB

Download