873e9a0d9a17a18b1da836449e9be94a3a71c8c0fd20833cceba86b360a1b896

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 18:21

Target

BoostrapperV3.exe
Size

64.2MB
MD5

49e2f70f0baa0f20515e0963214711e3
SHA1

f5fd3d8f31a21641bde133abfadcff62bc2c81a9
SHA256

873e9a0d9a17a18b1da836449e9be94a3a71c8c0fd20833cceba86b360a1b896
SHA512

e7df989a0f3a0b3f4a950930082f9c9e96451a7ddbdb1884f36c68ea514edf6b09d46f448757ddf6f6b3f05b2b8bc0d9a1650439478ed0b84c51686f36cc4e78
SSDEEP

1572864:FVqXyvPluz7Tvtmq3D4lS9J3q6y7M1jv78MHKE:bTvPluTZsSrM7iRh

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3000	BoostrapperV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a47f-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 3000	2052	BoostrapperV3.exe	30
PID 2052 wrote to memory of 3000	2052	BoostrapperV3.exe	30
PID 2052 wrote to memory of 3000	2052	BoostrapperV3.exe	30

C:\Users\Admin\AppData\Local\Temp\BoostrapperV3.exe
"C:\Users\Admin\AppData\Local\Temp\BoostrapperV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\BoostrapperV3.exe
  "C:\Users\Admin\AppData\Local\Temp\BoostrapperV3.exe"
  2⤵
  - Loads dropped DLL
  PID:3000

C:\Users\Admin\AppData\Local\Temp\_MEI20522\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
memory/3000-24-0x000007FEF5E20000-0x000007FEF6408000-memory.dmp

Filesize
5.9MB

Download