c4439a3aebb0225e9e56775ed819aa466883d456bb4e5a821e1124b767140b6d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 20:03

Target

ElectronV3.exe
Size

19.3MB
MD5

b0885502ec66d85a82d73b72f9ed80f5
SHA1

982595a8a4de3cfc69f9215e72ca24c55f92e465
SHA256

c4439a3aebb0225e9e56775ed819aa466883d456bb4e5a821e1124b767140b6d
SHA512

735720c116f90e3aaaa2beaaf826013fe6c168bb603f4c5132d3fa2959392a7ef4a52c971bf51f6d1479fa128f2a3308605cd03594c2736adcff09d87aac79f0
SSDEEP

196608:G8QCuxCmDAJediqShxWTMRHvUWvo3hxjno/w3iFCxHQbRpXFJf5Pc:oBShATMRHdgxro/w3uCxHQb1Jh

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2656	ElectronV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019b03-46.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2656	2612	ElectronV3.exe	30
PID 2612 wrote to memory of 2656	2612	ElectronV3.exe	30
PID 2612 wrote to memory of 2656	2612	ElectronV3.exe	30

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2656

C:\Users\Admin\AppData\Local\Temp\_MEI26122\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2656-48-0x000007FEF6400000-0x000007FEF6865000-memory.dmp

Filesize
4.4MB

Download