2dc86fd9e7b5746036284768f475ea9c3268c8bfc6cd4001f9a27bb923028467

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 13:04

Target

aquaV.exe
Size

7.4MB
MD5

49aa048767303db8685115ce421fa3ec
SHA1

259179216bae1ce03d880549f25de447324cf589
SHA256

2dc86fd9e7b5746036284768f475ea9c3268c8bfc6cd4001f9a27bb923028467
SHA512

f2b28a672ead669a7a133d253dfc142952055ad1579bd762a0cb75c281d79b524d30cb489d6bc7643191bce2cad1b150f47a9a632c8b804358cddee8bd6e1d1b
SSDEEP

98304:2JSi8x9XQsTurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EAKhOC112j:2QP9VTurErvI9pWjgfPvzm6gsFE14A0

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

aquaV.exe

pid process

1724 aquaV.exe

pid	process
1724	aquaV.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI25642\python311.dll	upx
behavioral1/memory/1724-23-0x000007FEF62F0000-0x000007FEF68E2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

aquaV.exe

description	pid	process	target process
PID 2564 wrote to memory of 1724	2564	aquaV.exe	aquaV.exe
PID 2564 wrote to memory of 1724	2564	aquaV.exe	aquaV.exe
PID 2564 wrote to memory of 1724	2564	aquaV.exe	aquaV.exe

C:\Users\Admin\AppData\Local\Temp\aquaV.exe
"C:\Users\Admin\AppData\Local\Temp\aquaV.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Users\Admin\AppData\Local\Temp\aquaV.exe
"C:\Users\Admin\AppData\Local\Temp\aquaV.exe"
2⤵
- Loads dropped DLL
PID:1724

C:\Users\Admin\AppData\Local\Temp\_MEI25642\python311.dll
Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/1724-23-0x000007FEF62F0000-0x000007FEF68E2000-memory.dmp

Filesize
5.9MB

Download