58be5988b695cac73ceb09a2626505f57774c5120c35566f8524fd5c317f8cbb

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 02:38

Target

Venus Tool/Venus Tool.exe
Size

5.9MB
MD5

4238a832dbee926a3888e4ca18c9bff8
SHA1

3d1a7c8a85b33f7b71b6e3cd608c70b5fa19b07d
SHA256

88c11f9c63b5ab1f0e479c6d0fce5f9262496f7b76a918256181b677451909e3
SHA512

81fec5d57208a7f49dd3fed769841709e8ad890d277e1b6ee83b36c93608df18d8577bd7e61915d60f2c01aa3467ff5c36501a8fba4c85d9cbfdb48783663690
SSDEEP

98304:rN+nhjdRai65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFl9hikrK0ZM:rAnpIDOYjJlpZstQoS9Hf12VKX6biCGV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2256	Venus Tool.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016ce4-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2256	2436	Venus Tool.exe	28
PID 2436 wrote to memory of 2256	2436	Venus Tool.exe	28
PID 2436 wrote to memory of 2256	2436	Venus Tool.exe	28

C:\Users\Admin\AppData\Local\Temp\Venus Tool\Venus Tool.exe
"C:\Users\Admin\AppData\Local\Temp\Venus Tool\Venus Tool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\Venus Tool\Venus Tool.exe
  "C:\Users\Admin\AppData\Local\Temp\Venus Tool\Venus Tool.exe"
  2⤵
  - Loads dropped DLL
  PID:2256

C:\Users\Admin\AppData\Local\Temp\_MEI24362\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/2256-23-0x000007FEF59D0000-0x000007FEF5E35000-memory.dmp

Filesize
4.4MB

Download