aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29

Analysis

max time kernel
361s
max time network
363s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 14:35

Target

Hebleeds.exe
Size

34.1MB
MD5

ba1d0780f519ee2807e153d51df5916e
SHA1

03f9b5b21a1911ea068e668b041ff827ca0891d7
SHA256

aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29
SHA512

d31b05daeb984427c4b5c476169cdab442723c51324938fc3df700f91ecb35b5b5ba5b1b11297c170fcee0bf2c56d9db7b2ef18b289042eb7a7373745faa9d89
SSDEEP

786432:3p039FS+ab44n6ASQSc6k00CZcKoTMS4uEgbFtNFEtKN:3ps9Fnab4+6DQSc6JUCS1NOK

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Hebleeds.exe

pid	Process
2976	Hebleeds.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x000500000001a40f-12.dat	upx
behavioral1/memory/2976-14-0x000007FEF6570000-0x000007FEF69D6000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Hebleeds.exe

pid	Process
2976	Hebleeds.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Hebleeds.exe

description	pid	Process	procid_target
PID 2792 wrote to memory of 2976	2792	Hebleeds.exe	30
PID 2792 wrote to memory of 2976	2792	Hebleeds.exe	30
PID 2792 wrote to memory of 2976	2792	Hebleeds.exe	30

C:\Users\Admin\AppData\Local\Temp\Hebleeds.exe
"C:\Users\Admin\AppData\Local\Temp\Hebleeds.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\Hebleeds.exe
  "C:\Users\Admin\AppData\Local\Temp\Hebleeds.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2976

C:\Users\Admin\AppData\Local\Temp\_MEI27922\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2976-14-0x000007FEF6570000-0x000007FEF69D6000-memory.dmp

Filesize
4.4MB

Download
memory/2976-15-0x000007FEF6570000-0x000007FEF69D6000-memory.dmp

Filesize
4.4MB

Download