ea467b3f753377e18a974e1d82b587d7260087cfbb4ba3ccbe3d3c35c68a2ca9

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
31/07/2024, 04:37

Target
VPN.exe
Size 77.6MB
Sample240731-e8wndsxalk
SHA256 ea467b3f753377e18a974e1d82b587d7260087cfbb4ba3ccbe3d3c35c68a2ca9
MD5 de7d00c3437861d5777667cc1ff0f4ff
SHA1 34a480c737593a69fa0842d6b0db631a1ba92d2a
SHA512 095af115f542b79940177ca6da3ba4e496c05b3cdfb9c74da85f3491f2c2670c47883a5000b862d9150ff58d0190b2cda5b82ae79d1f664fedd745bee7c0797e
SSDEEP 1572864:/vHcRlq9h7vXSk8IpG7V+VPhqWdfME7FFlHFziYweyJulZUdgAdW4Kauxa/Z9UN/:/vHcRahTSkB05awqfhdCpukdR6s9U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
532	VPN.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d3b5-1273.dat	upx
behavioral1/memory/532-1275-0x000007FEF5BE0000-0x000007FEF62A4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 532	2756	VPN.exe	31
PID 2756 wrote to memory of 532	2756	VPN.exe	31
PID 2756 wrote to memory of 532	2756	VPN.exe	31

C:\Users\Admin\AppData\Local\Temp\VPN.exe
"C:\Users\Admin\AppData\Local\Temp\VPN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\VPN.exe
  "C:\Users\Admin\AppData\Local\Temp\VPN.exe"
  2⤵
  - Loads dropped DLL
  PID:532

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\python312.dll
Size 1.7MB
SHA256 e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5
MD5 506c760a20e6bb940590229d41449ffa
SHA1 b7c439f253987fb0ff66fc5ce959cf711b18eb8d
SHA512 34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e
SSDEEP 49152:EnCZdKhFC0D7jeJ/7oTvMUGRcAjO/rAAoBrJiI9Q:Ecd0J7ZGKyBrJZQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI27562\wheel-0.43.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

memory/532-1275-0x000007FEF5BE0000-0x000007FEF62A4000-memory.dmp

Download