4b86d94ea8d7d5b71d124fdb17165df75aaee0c89d206384f7653839e696d542

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
31-07-2024 17:22

Target

Maple Raider Latest/Maple Raider.exe
Size

34.1MB
MD5

ba1d0780f519ee2807e153d51df5916e
SHA1

03f9b5b21a1911ea068e668b041ff827ca0891d7
SHA256

aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29
SHA512

d31b05daeb984427c4b5c476169cdab442723c51324938fc3df700f91ecb35b5b5ba5b1b11297c170fcee0bf2c56d9db7b2ef18b289042eb7a7373745faa9d89
SSDEEP

786432:3p039FS+ab44n6ASQSc6k00CZcKoTMS4uEgbFtNFEtKN:3ps9Fnab4+6DQSc6JUCS1NOK

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Maple Raider.exe

pid process

1860 Maple Raider.exe

pid	process
1860	Maple Raider.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI21642\python310.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Maple Raider.exe

description	pid	process	target process
PID 2164 wrote to memory of 1860	2164	Maple Raider.exe	Maple Raider.exe
PID 2164 wrote to memory of 1860	2164	Maple Raider.exe	Maple Raider.exe
PID 2164 wrote to memory of 1860	2164	Maple Raider.exe	Maple Raider.exe

C:\Users\Admin\AppData\Local\Temp\Maple Raider Latest\Maple Raider.exe
"C:\Users\Admin\AppData\Local\Temp\Maple Raider Latest\Maple Raider.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\Maple Raider Latest\Maple Raider.exe
  "C:\Users\Admin\AppData\Local\Temp\Maple Raider Latest\Maple Raider.exe"
  2⤵
  - Loads dropped DLL
  PID:1860

C:\Users\Admin\AppData\Local\Temp\_MEI21642\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/1860-14-0x000007FEF61D0000-0x000007FEF6636000-memory.dmp

Filesize
4.4MB

Download