05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90

Analysis

max time kernel
15s
max time network
15s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 13:41

Target

05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe
Size

74.3MB
MD5

9363460960dc7c6d65fb4028b3ede6fb
SHA1

bb1b39fb45af4986253c84615e06f0a7f015da04
SHA256

05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90
SHA512

ac174080ca9c12b63fae1e0422d05c2b5966429771e86a46faf5246236ece71df683840a18ec45c9a0c8ddb9173de1b50355c51c1793070f5867c148f307da17
SSDEEP

1572864:JvHcRl9Sk8IpG7V+VPhqYdfME7FFltFziYweyJulZUdgAdW4Mjeuxfa/Z9U:JvHcRTSkB05awcfh3CpukdRwXY9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2188	05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000300000001cfbe-1241.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2188	2884	05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe	29
PID 2884 wrote to memory of 2188	2884	05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe	29
PID 2884 wrote to memory of 2188	2884	05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe	29

C:\Users\Admin\AppData\Local\Temp\05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe
"C:\Users\Admin\AppData\Local\Temp\05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe
  "C:\Users\Admin\AppData\Local\Temp\05ffb3a5d30b3dd0c922cebb54d73efcebd2e396985dec5a3cef8632dfce4d90.exe"
  2⤵
  - Loads dropped DLL
  PID:2188

C:\Users\Admin\AppData\Local\Temp\_MEI28842\python312.dll

Filesize
1.7MB

MD5
506c760a20e6bb940590229d41449ffa

SHA1
b7c439f253987fb0ff66fc5ce959cf711b18eb8d

SHA256
e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5

SHA512
34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e

Download Submit
memory/2188-1243-0x000007FEF5960000-0x000007FEF6024000-memory.dmp

Filesize
6.8MB

Download