5188c69bd772ebe6ca8b34e8c08eec90f63ffcf1d6ab20287e074732da21076a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 22:30

Target

jet/loader.exe
Size

39.3MB
MD5

cb5900d8c99b9b2b8391c5e07de93048
SHA1

21434e75d38c698a924a28a39498f230ba1e23f2
SHA256

53d60f5a2e65c6aae90eb6e9f872cd381fc152f33e8227bef5fe27d61e09ceb3
SHA512

148be276c6a8b98971c975c27a7b4d27146667b80447198d09777131b2dd5511de51db3ded5b3d04b72a85f12f772792e0590427c3cbceb2b1d9b5420d9d205d
SSDEEP

786432:vp039FS+ab44n6ASQSc6k00CZcKoTMS4n4BgmpHvT6CKrftQKN:vps9Fnab4+6DQSc6JUCSC4hH2CKLtQK

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3056	loader.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral9/files/0x0005000000019625-12.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3056	2340	loader.exe	31
PID 2340 wrote to memory of 3056	2340	loader.exe	31
PID 2340 wrote to memory of 3056	2340	loader.exe	31

C:\Users\Admin\AppData\Local\Temp\jet\loader.exe
"C:\Users\Admin\AppData\Local\Temp\jet\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\jet\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\jet\loader.exe"
  2⤵
  - Loads dropped DLL
  PID:3056

C:\Users\Admin\AppData\Local\Temp\_MEI23402\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/3056-14-0x000007FEF68E0000-0x000007FEF6D46000-memory.dmp

Filesize
4.4MB

Download