f8d6e69489d281d3c1b30f0365dfba3290543dff6a92ed984d9ca9ae2df64ee7

Analysis

max time kernel
14s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 11:52

Target

Scorpix-ExecutorV2.12.exe
Size

57.2MB
MD5

63c72c7a89e103964461f3bc6eaf7b20
SHA1

eb1a4d52dbe5a8e31cdd23e28c142172154e868e
SHA256

f8d6e69489d281d3c1b30f0365dfba3290543dff6a92ed984d9ca9ae2df64ee7
SHA512

5f424a2ee2c1c5b54e89dcc32689d2d039f6af950af2c03694cda676237378a9702ded1942571e698d2cbd6a7c04889593c890518a40304ffde9c4d74be5af67
SSDEEP

786432:HI9AOQm7QqMoknvNpA+vIlo0FdGgr3OKvIjjk3ESWqEp+0/pWTf0ca+/:HqAOQcQqMrlpA+Ql4GxvIswqrSIfa+/

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1760	Scorpix-ExecutorV2.12.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020873-737.dat	upx
behavioral1/memory/1760-739-0x000007FEF5AC0000-0x000007FEF60A8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1760	2980	Scorpix-ExecutorV2.12.exe	30
PID 2980 wrote to memory of 1760	2980	Scorpix-ExecutorV2.12.exe	30
PID 2980 wrote to memory of 1760	2980	Scorpix-ExecutorV2.12.exe	30

C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV2.12.exe
"C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV2.12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV2.12.exe
  "C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV2.12.exe"
  2⤵
  - Loads dropped DLL
  PID:1760

C:\Users\Admin\AppData\Local\Temp\_MEI29802\python311.dll

Filesize
1.6MB

MD5
4fcf14c7837f8b127156b8a558db0bb2

SHA1
8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f

SHA256
a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc

SHA512
7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8

Download Submit
memory/1760-739-0x000007FEF5AC0000-0x000007FEF60A8000-memory.dmp

Filesize
5.9MB

Download