5bf4ef05306f70dbd00f0229589a6e2fb1dfe0d5f8a8e41f6d82288ebb42771f

Analysis

max time kernel
9s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 19:43

Target

Exela.exe
Size

12.9MB
MD5

19371f2e016a86609463eca02c003013
SHA1

2a7427f9813f8142cec8000dbeb4433e760d0636
SHA256

5bf4ef05306f70dbd00f0229589a6e2fb1dfe0d5f8a8e41f6d82288ebb42771f
SHA512

43fbcbd872f1d82cb929823ee173098d79c4c8456c50c4e351c1cf1aa0c9c637ae77c402bb8c2581e743f4370e5218ed118201d3f2e97978fae2283367817c81
SSDEEP

196608:es2Qkd49U8mtS+urErvI9pWj+sgX3ZdahF0wB1AajGlijPOk91tQOmWVxxF:TKOatS+urEUWj/gXe7b+ijPtT6OL

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2784	Exela.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a358-54.dat	upx
behavioral1/memory/2784-56-0x000007FEF5960000-0x000007FEF6024000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2784	2140	Exela.exe	29
PID 2140 wrote to memory of 2784	2140	Exela.exe	29
PID 2140 wrote to memory of 2784	2140	Exela.exe	29

C:\Users\Admin\AppData\Local\Temp\Exela.exe
"C:\Users\Admin\AppData\Local\Temp\Exela.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\Exela.exe
  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
  2⤵
  - Loads dropped DLL
  PID:2784

C:\Users\Admin\AppData\Local\Temp\_MEI21402\python312.dll

Filesize
1.7MB

MD5
01be3c75babc89c73e1f97286e2d254a

SHA1
bc54e991fbcccbca12159da53757f3e0739074dc

SHA256
ceced46d2deb9e7a1c74819cd5cad12c7bc291c163f292c7581eb35b50e97936

SHA512
6712adeaaecf511186ccc12a3dfce6221c1eeab498222ada5d4626abfe52520d55acd515fbc2c1b2791b8cdb45e585741c6349808a4e83b8aaba24c69a08ce52

Download Submit
memory/2784-56-0x000007FEF5960000-0x000007FEF6024000-memory.dmp

Filesize
6.8MB

Download