fec6107f08e216d76cf05ee65f1894de778b386b61cb6c459f6c0f6657de2c6f

Resubmissions

18-07-2024 04:33

18-07-2024 04:29

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18-07-2024 04:33

Target

ElectronV3.exe
Size

37.2MB
MD5

35ff4b8cfa381b8c421d7f4278e5eea2
SHA1

c686165b7dd71d48433e5298be2fec7e6c6b64dd
SHA256

fec6107f08e216d76cf05ee65f1894de778b386b61cb6c459f6c0f6657de2c6f
SHA512

0f31fc013005b38cb0be2cd33780627364e4e70683670bbc0ab3ffd154c229b97dacffc895c503a4c8689f4d627ec5e6b3e69394871349ccd6c64977d11b4e0e
SSDEEP

786432:y9OQxKKj1YqIdryuIjHNOgi5EMkhqN+NhAiJ1piKvIeVrsgv3FdbfitHJblxb:EOQAKjSqMhIjHNm5Dkq4bAodvIeVrhdO

Score

7^/10

upx

Loads dropped DLL 5 IoCs

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cba9-129.dat	upx
behavioral1/memory/2904-131-0x000007FEF5AA0000-0x000007FEF5F05000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2904	ElectronV3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2904	2756	ElectronV3.exe	30
PID 2756 wrote to memory of 2904	2756	ElectronV3.exe	30
PID 2756 wrote to memory of 2904	2756	ElectronV3.exe	30

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2904

C:\Users\Admin\AppData\Local\Temp\_MEI27562\python310.dll

Filesize
1.4MB

MD5
fea8b50c9cd4738b0ca28fe61705a77d

SHA1
fb84ab201b017ca27099558b6fb26701efe9612b

SHA256
56cd8356f6e4d4bde52672f58cc657f527cd07f67207bfb17afa0017f3f5d325

SHA512
21d98cb5b87a7c553ec2f1f935987731d2d9ce788f27746f1255fb0a475ae832453f7672081d06fdc31774e0ed64bb6855f4daa9f099bb0ac37179cd491bbe10

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI27562\python3.dll

Filesize
60KB

MD5
a5471f05fd616b0f8e582211ea470a15

SHA1
cb5f8bf048dc4fc58f80bdfd2e04570dbef4730e

SHA256
8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790

SHA512
e87d06778201615b129dcf4e8b4059399128276eb87102b5c3a64b6e92714f6b0d5bde5df4413cc1b66d33a77d7a3912eaa1035f73565dbfd62280d09d46abff

Download Submit
memory/2904-131-0x000007FEF5AA0000-0x000007FEF5F05000-memory.dmp

Filesize
4.4MB

Download
memory/2904-132-0x000007FEF5AA0000-0x000007FEF5F05000-memory.dmp

Filesize
4.4MB

Download