fec6107f08e216d76cf05ee65f1894de778b386b61cb6c459f6c0f6657de2c6f

Resubmissions

18-07-2024 04:33

18-07-2024 04:29

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 04:29

Target

ElectronV3.exe
Size

37.2MB
MD5

35ff4b8cfa381b8c421d7f4278e5eea2
SHA1

c686165b7dd71d48433e5298be2fec7e6c6b64dd
SHA256

fec6107f08e216d76cf05ee65f1894de778b386b61cb6c459f6c0f6657de2c6f
SHA512

0f31fc013005b38cb0be2cd33780627364e4e70683670bbc0ab3ffd154c229b97dacffc895c503a4c8689f4d627ec5e6b3e69394871349ccd6c64977d11b4e0e
SSDEEP

786432:y9OQxKKj1YqIdryuIjHNOgi5EMkhqN+NhAiJ1piKvIeVrsgv3FdbfitHJblxb:EOQAKjSqMhIjHNm5Dkq4bAodvIeVrhdO

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2068	ElectronV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4f4-129.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2068	2372	ElectronV3.exe	31
PID 2372 wrote to memory of 2068	2372	ElectronV3.exe	31
PID 2372 wrote to memory of 2068	2372	ElectronV3.exe	31

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2068

C:\Users\Admin\AppData\Local\Temp\_MEI23722\python310.dll

Filesize
1.4MB

MD5
fea8b50c9cd4738b0ca28fe61705a77d

SHA1
fb84ab201b017ca27099558b6fb26701efe9612b

SHA256
56cd8356f6e4d4bde52672f58cc657f527cd07f67207bfb17afa0017f3f5d325

SHA512
21d98cb5b87a7c553ec2f1f935987731d2d9ce788f27746f1255fb0a475ae832453f7672081d06fdc31774e0ed64bb6855f4daa9f099bb0ac37179cd491bbe10

Download Submit
memory/2068-131-0x000007FEF5AE0000-0x000007FEF5F45000-memory.dmp

Filesize
4.4MB

Download