bf6bc8ca3a99840471241fc42e8a495313b9cfa0564523c2639aede47afe07e6

Analysis

max time kernel
1560s
max time network
1566s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 03:43

Target
source_prepared.exe
Size 80.6MB
Sample240719-d91hasvbjc
SHA256 bf6bc8ca3a99840471241fc42e8a495313b9cfa0564523c2639aede47afe07e6
MD5 760e7694f6a8bdc904dacd1dd35ce689
SHA1 2e47d75340b9f4292332295f0ba6a0d638bda1f3
SHA512 97c57e98661e30962eaf9e553c5dd12930d1fcf8e8a9057db1cbf55392334b980c5e2ec272dfffa6c7fea2c0a4d08d244c1b53bd7d6ff302bb67cc1b2f350109
SSDEEP 1572864:lvxZQgl4Sk8IpG7V+VPhqYdfCE7jlgJiYgj+h58sMwcWv9MBzcJXP:lvxZx+SkB05awcfHeL5wy9MW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
824	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d298-1260.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 824	2264	source_prepared.exe	30
PID 2264 wrote to memory of 824	2264	source_prepared.exe	30
PID 2264 wrote to memory of 824	2264	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:824

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI22642\python311.dll
Size 1.6MB
SHA256 4a6a3b70293915516a4503f60d3eba8f9db22e84918e17cb09fe9f76c5a2db8b
MD5 335b4e7bf9b78b1ea902220cdb506506
SHA1 5ea9c9df911267392109d44a88727d3cfebb6d49
SHA512 3ba072b9acea573c0bc1819f3f434a1b0f1bd940efcbed7bb3d227ecca6cf413903815c7bb9299718db8df496c8c74c406b47f0331f2445243e09b55f8581be2
SSDEEP 24576:4JvPPQ9M/dLELzCFPObgFBJLV8FEiQvWZcUHjdhvDCmAUjJpbgsjVhmjQfrOt2xG:QP5LELznbKdMnQkcUDdlpAwS+h5qCop
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/824-1262-0x000007FEF51E0000-0x000007FEF57D0000-memory.dmp

Download