6ebb8752fca8db5f80fdcc3dda6dc4578df21307695cef2ad5a4dfcf2ae41c29

Analysis

max time kernel
1563s
max time network
1567s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 21:39

Target

main.exe
Size

114.8MB
MD5

e94a72108996009df0b056674a7afc46
SHA1

e1209f2e815d51c32594eaaf0a8be87508650405
SHA256

6ebb8752fca8db5f80fdcc3dda6dc4578df21307695cef2ad5a4dfcf2ae41c29
SHA512

6b8977b5969b252b7b5c416e3ebc0e354ca990532e7bd82de95ec78ad206f267cd8875f8b4d89167cbd95d79c80c096737769793f5b93bd2903b8339636c6e3e
SSDEEP

3145728:ubhuUAUE+1WZH5zFOH1uD+hYaUdsuOYnRfsqq:26hJDgqPiq

Score

7^/10

upx

pid	process
2140	main.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI16762\python311.dll	upx
behavioral1/memory/2140-14-0x000007FEF5890000-0x000007FEF5E82000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

main.exe

description	pid	process	target process
PID 1676 wrote to memory of 2140	1676	main.exe	main.exe
PID 1676 wrote to memory of 2140	1676	main.exe	main.exe
PID 1676 wrote to memory of 2140	1676	main.exe	main.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  PID:2140

C:\Users\Admin\AppData\Local\Temp\_MEI16762\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2140-14-0x000007FEF5890000-0x000007FEF5E82000-memory.dmp

Filesize
5.9MB

Download