8d6d98db39378ee1e4e69153d660b1711abd7a88e099c8369aa352fe7c97c0a1

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 01:44

Target
silence.exe
Size 76.7MB
Sample240703-b59t3a1cne
SHA256 8d6d98db39378ee1e4e69153d660b1711abd7a88e099c8369aa352fe7c97c0a1
MD5 373858f96cd1047056fc02f86993644a
SHA1 bc97f3b751577fa4bd9c1e71a7d33ecb5b7f9d66
SHA512 e92c426462abef97be23a0a46e1c15743e582fa511c777f26635bad51f3dfe1d78d63cec804cd9ef1af20e5baf03b2dcd776b702ef8cc77653bef7b7c995f844
SSDEEP 1572864:zvHcRlWSk8IpG7V+VPhqYdfME7ZlH/iYweyJulZUdgu0WV7jIJgRqZ9U:zvHcRcSkB05awcfvdQpuK0cnS9U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2544	silence.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cccd-1252.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2544	2416	silence.exe	28
PID 2416 wrote to memory of 2544	2416	silence.exe	28
PID 2416 wrote to memory of 2544	2416	silence.exe	28

C:\Users\Admin\AppData\Local\Temp\silence.exe
"C:\Users\Admin\AppData\Local\Temp\silence.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\silence.exe
  "C:\Users\Admin\AppData\Local\Temp\silence.exe"
  2⤵
  - Loads dropped DLL
  PID:2544

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24162\python312.dll
Size 1.7MB
SHA256 b598545be6c99f7db852a510768ecf80ed353fad3989af342bc6faf66fd64648
MD5 73ecc8d4decf6f198d6505bde482e37a
SHA1 ed30f5bd628b4a5de079062ea9b909b99807021c
SHA512 56923c477d35680aed73980e0404768f841da868ca11f39888caff0fc06f4ae906551b4bd47f98dda2cc2d81ea9eed17fa7c17aa59d4d7c37510ba24d7ac5976
SSDEEP 49152:Qm7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:N7uJcZX6pumfJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2544-1254-0x000007FEF5B40000-0x000007FEF6205000-memory.dmp

Download