ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 10:43

Target

c-realV2.exe
Size

9.8MB
MD5

cf88f81270f9a6abb71bdfacb7c5fc96
SHA1

6a99eb6f3b0b266136f86f81070afe8df4622615
SHA256

ac7bf1cf5d4b2ec6de9bc3e5f4402df6d9d7ebe089cdcbbcf7be8a8995a56f1a
SHA512

6657b2eab3d2af4985d46ca7fc78c92d1cc9a3913b2bbb0182dcd13702e9e58abac7273727afca031bb826f8e9e99c2e881ff7cfe1b0bdd2b9e7b68a04ee9785
SSDEEP

196608:O2RuMeNj9iBqRsj41YWuJ8IcUeOYXOxfOsYk6dnvz16:0TUaYBJ8IcVO/xqdY

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2620	c-realV2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016cc1-32.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2620	1668	c-realV2.exe	29
PID 1668 wrote to memory of 2620	1668	c-realV2.exe	29
PID 1668 wrote to memory of 2620	1668	c-realV2.exe	29

C:\Users\Admin\AppData\Local\Temp\c-realV2.exe
"C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\c-realV2.exe
  "C:\Users\Admin\AppData\Local\Temp\c-realV2.exe"
  2⤵
  - Loads dropped DLL
  PID:2620

C:\Users\Admin\AppData\Local\Temp\_MEI16682\python311.dll

Filesize
1.6MB

MD5
5ef44effa518fc9b3acda79684381d75

SHA1
df6d1a46e691dce3373800b188137eed4ce97dfc

SHA256
90fe310cce48c73f05b7e678a36f2d6bb8870c316b9f12495255b60ad7787777

SHA512
ca52ccd9dedfb03d38544cb2f5a248d52873f7ef143ee3693d2fe11e941e81c5a48da277dbe0cdcf5b01701778ba083d0355fdfef0c13faa59411e7e12e5928c

Download Submit
memory/2620-34-0x000007FEF5B80000-0x000007FEF6169000-memory.dmp

Filesize
5.9MB

Download
memory/2620-66-0x000007FEF5B80000-0x000007FEF6169000-memory.dmp

Filesize
5.9MB

Download