db0d623ba3e20c740268c11638f22a96d9a4453dc8f1dc54839da993cca59abd

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 17:48

Target

FnPuller.exe
Size

16.4MB
MD5

bedc28d5ba8af8459f85d57a8b3b9f9a
SHA1

a2eefb7bda74ad01cef606390593a1ebfc2e1709
SHA256

db0d623ba3e20c740268c11638f22a96d9a4453dc8f1dc54839da993cca59abd
SHA512

726d98ee61ad7108bb0d82217bb9ac392e3279204bc1a83c01c9c4c6fd119861ee387820d9c0f03b7d7762f742b60dd562185ebbf29926c687d06e190d8516eb
SSDEEP

196608:E0NpUXDB2Mi0sKYu/PaQZXGnOrzGsyHHICEB6yBC+K6kHWMbgdOLv0zGil64ofxI:MXoQZXGOrzGseICEBRB8RD07DofTESV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2616	FnPuller.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001c8cf-100.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2616	2512	FnPuller.exe	30
PID 2512 wrote to memory of 2616	2512	FnPuller.exe	30
PID 2512 wrote to memory of 2616	2512	FnPuller.exe	30

C:\Users\Admin\AppData\Local\Temp\FnPuller.exe
"C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\FnPuller.exe
  "C:\Users\Admin\AppData\Local\Temp\FnPuller.exe"
  2⤵
  - Loads dropped DLL
  PID:2616

C:\Users\Admin\AppData\Local\Temp\_MEI25122\python310.dll

Filesize
1.4MB

MD5
f88ce4e677e2fae8e465111349e3ab15

SHA1
d6c4f7283c4d949af2cf9eedd756f3f625cc400d

SHA256
0c404b474c574ce4aa301b6a2528643e0008bf6ec0a3db5b8b436f1cca51ad04

SHA512
58ebf534c38ceb26813c9c588d74050688a1ca75bb4d66a45eeea34942fd0352a846796e3eafd8bd9c483a194dd6aa62dad7c10bd3830cb60b5a8345e559e1f2

Download Submit
memory/2616-102-0x000007FEF6C00000-0x000007FEF7066000-memory.dmp

Filesize
4.4MB

Download