75baa86a709dfb96ae2dfaf3aaa912784529c0973e7372da9095c3385ad20550

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 12:05

Target
ratatouie.exe
Size 77.7MB
Sample240806-n89ppasepc
SHA256 75baa86a709dfb96ae2dfaf3aaa912784529c0973e7372da9095c3385ad20550
MD5 42ea556a908699ac565b40a55cb10d31
SHA1 6e397a22e7850e782d13cc6b4c65ad27e05e7d78
SHA512 b55b861e980ebd07cf6c2ae85dc088aa615a0c421967a9bdc6bfbf8302f0d3c9544a61eaf8a50bc641c70346866f30c952f059f25b98b53a81b975ed0c29ef2d
SSDEEP 1572864:BvHcRlYh7vXSk8IpG7V+VPhqWdfME7ZlH/iYweyJulZUdgu0WV6GjRqZ9UdS:BvHcRmhTSkB05awqfvdQpuK0cw9U
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1732	ratatouie.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d5d0-1272.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1732	2524	ratatouie.exe	31
PID 2524 wrote to memory of 1732	2524	ratatouie.exe	31
PID 2524 wrote to memory of 1732	2524	ratatouie.exe	31

C:\Users\Admin\AppData\Local\Temp\ratatouie.exe
"C:\Users\Admin\AppData\Local\Temp\ratatouie.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\ratatouie.exe
  "C:\Users\Admin\AppData\Local\Temp\ratatouie.exe"
  2⤵
  - Loads dropped DLL
  PID:1732

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\python312.dll
Size 1.7MB
SHA256 b598545be6c99f7db852a510768ecf80ed353fad3989af342bc6faf66fd64648
MD5 73ecc8d4decf6f198d6505bde482e37a
SHA1 ed30f5bd628b4a5de079062ea9b909b99807021c
SHA512 56923c477d35680aed73980e0404768f841da868ca11f39888caff0fc06f4ae906551b4bd47f98dda2cc2d81ea9eed17fa7c17aa59d4d7c37510ba24d7ac5976
SSDEEP 49152:Qm7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:N7uJcZX6pumfJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\wheel-0.43.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

memory/1732-1274-0x000007FEF6480000-0x000007FEF6B45000-memory.dmp

Download