b1456019af0fe7bdf9c7a6a6be30dc8a26dafa8a4ac5d4819c907096e90ee713

Analysis

max time kernel
8s
max time network
7s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 04:09

Target

Scorpix-ExecutorV3.exe
Size

62.6MB
MD5

e69537058c4b20b7603e092f84a51204
SHA1

218a1a8bf45b8c556527abf4eee88a33a38f9458
SHA256

b1456019af0fe7bdf9c7a6a6be30dc8a26dafa8a4ac5d4819c907096e90ee713
SHA512

68ddf818301e74e3da1453fed0bb1cf7ca26522dd2ecfd498204637a2f6169550c4450488e6cbffd49176302aec70603ad7dfae9b58438022e8815fbe44adda2
SSDEEP

786432:a9AOQm7QqMoknvNpA+vIlo0FdGgrMJrvUFzr2KvIjjk3ESWqEp+0/pWTf0ca+S:MAOQcQqMrlpA+Ql4DGpvIswqrSIfa+S

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1304	Scorpix-ExecutorV3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000300000001e541-737.dat	upx
behavioral1/memory/1304-739-0x000007FEF5A60000-0x000007FEF6048000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1304	1840	Scorpix-ExecutorV3.exe	29
PID 1840 wrote to memory of 1304	1840	Scorpix-ExecutorV3.exe	29
PID 1840 wrote to memory of 1304	1840	Scorpix-ExecutorV3.exe	29

C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV3.exe
"C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV3.exe
  "C:\Users\Admin\AppData\Local\Temp\Scorpix-ExecutorV3.exe"
  2⤵
  - Loads dropped DLL
  PID:1304

C:\Users\Admin\AppData\Local\Temp\_MEI18402\python311.dll

Filesize
1.6MB

MD5
4fcf14c7837f8b127156b8a558db0bb2

SHA1
8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f

SHA256
a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc

SHA512
7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8

Download Submit
memory/1304-739-0x000007FEF5A60000-0x000007FEF6048000-memory.dmp

Filesize
5.9MB

Download