6b54534840c6db880d910e5b016ccb1f1cb1911dd1a68aff12ac6296d144458f

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 11:23

Target

source_prepared.exe
Size

80.8MB
MD5

abe6386e8dd005a356a274c8c54817f2
SHA1

eaf5dc405b26bf2cdfc0a53562933dd4f9bc6d2a
SHA256

6b54534840c6db880d910e5b016ccb1f1cb1911dd1a68aff12ac6296d144458f
SHA512

dcd193f8324e34bb139cbcfdf34dd5ce883932b4eebb14d9b855f52a1aa5229a73ae0798d0599383d4ca270ad8840da49789490caae7f90896b70de02859ca0e
SSDEEP

1572864:LnvxZQglXE97vaSk8IpG7V+VPhqO+ydE7UlgSiYgj+h58sMwIIKWl9uqScJX0:LnvxZxReeSkB05awO+ypec5k1s9uA0

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1204	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d3c9-1266.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1204	2468	source_prepared.exe	31
PID 2468 wrote to memory of 1204	2468	source_prepared.exe	31
PID 2468 wrote to memory of 1204	2468	source_prepared.exe	31

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:1204

C:\Users\Admin\AppData\Local\Temp\_MEI24682\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
memory/1204-1268-0x000007FEF66A0000-0x000007FEF6C89000-memory.dmp

Filesize
5.9MB

Download