eaef9ea2e3475a45b8f8dddad3940d7bbe564dee0dec2a0ea572a94abc04edb4

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 18:48

Target

Exela.exe
Size

9.4MB
MD5

0fc98e6e61812fabb9fbb96f19b94d63
SHA1

27dbae46aac953eef4fb6a451bc71a61ec9f9ba1
SHA256

eaef9ea2e3475a45b8f8dddad3940d7bbe564dee0dec2a0ea572a94abc04edb4
SHA512

a36fc0d88175eb5dbc3a31ed61d58ad0b79b05eea5b27a06ffa5c4fb509f8d6522ff0851d82795313b167f41570d06a61623bd6e0ac541bcca7f6d5c2bdd0513
SSDEEP

196608:Sp9OmqxKtJb3tQk5tARHvUWvo3hxjno/w3iFCxHQbRpXn2rv3:GFt7v5tARHdgxro/w3uCxHQbQv

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2272	Exela.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c49-45.dat	upx
behavioral1/memory/2272-47-0x000007FEF5E70000-0x000007FEF62D5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2272	1712	Exela.exe	30
PID 1712 wrote to memory of 2272	1712	Exela.exe	30
PID 1712 wrote to memory of 2272	1712	Exela.exe	30

C:\Users\Admin\AppData\Local\Temp\Exela.exe
"C:\Users\Admin\AppData\Local\Temp\Exela.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\Exela.exe
  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
  2⤵
  - Loads dropped DLL
  PID:2272

C:\Users\Admin\AppData\Local\Temp\_MEI17122\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2272-47-0x000007FEF5E70000-0x000007FEF62D5000-memory.dmp

Filesize
4.4MB

Download