1ba9cdf09d555d1e8a977932c7619f029d632966f09b0c2fc19a56849fe94b27

Resubmissions

09/07/2024, 16:43

08/07/2024, 20:01

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 20:01

Target
Vanta Cheat/Vanta_Bootstrapper.exe
Size 74.4MB
Sample240708-yr2mvswepl
SHA256 a00e2b8ea020f0610aa2488084b5f223c133bd24dcccfa8e60e6336047e1836b
MD5 4093612623de322aa0c8d3db2cd9241f
SHA1 19c5a655e14591771eb5eb26fda38c2b800680a7
SHA512 2386b85eeddb91200cdb768fda7222ea1114e926bb528667da20bd909b3089e0a1b02e5167bf0de66cd3441ef0188fac9c68a00fd35597195f4369f6d7d46e9f
SSDEEP 1572864:TX2cRl4Sk8IpG7V+VPhqYdI8E7+lHWiYweyJulZUdgS0WVOjpJgRqZ9U:TX2cROSkB05awcIQdLpuO0cat9U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1724	Vanta_Bootstrapper.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d264-1242.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1724	1812	Vanta_Bootstrapper.exe	31
PID 1812 wrote to memory of 1724	1812	Vanta_Bootstrapper.exe	31
PID 1812 wrote to memory of 1724	1812	Vanta_Bootstrapper.exe	31

C:\Users\Admin\AppData\Local\Temp\Vanta Cheat\Vanta_Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Vanta Cheat\Vanta_Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\Vanta Cheat\Vanta_Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Vanta Cheat\Vanta_Bootstrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:1724

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18122\python312.dll
Size 1.7MB
SHA256 c49c511fa244815cc1ab62a4dab0a4a0ffc0a1b99ac9333f60a3f795b99f65ed
MD5 7ef625a8207c1a1a46cb084dfc747376
SHA1 8cc35164b7cda0ed43eb07fdb1ea62c23ae1b6f9
SHA512 0872033ee3dc46066db3a44693d3802b5d158ef9e0481d1e33275934800cea6a79870ac0776a85f113daa67d9629b6d8bc67cea3d2a99445114140de1c29e5a4
SSDEEP 49152:Zm7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:Q7uJcZX6pumfJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1724-1244-0x000007FEF5BD0000-0x000007FEF6295000-memory.dmp

Download