a5ef976d928a096d7e298343b16ba54632411dc7fcb97f93e229ea24702578db

Resubmissions

14-10-2024 14:49

16-08-2024 15:07

16-08-2024 14:46

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 14:46

Target

Built.exe
Size

7.4MB
MD5

5531aaf254a3ef858aa2808a87e6c3c0
SHA1

18a8a22cfa4f987dddef5ce39b2a6118ec32a196
SHA256

45567c82cc7277f5aa2cb693f6abfa0c0b91d2a472e91fe0643e17dab855d3a8
SHA512

2e880257c6da44836a19b2d8f7a47ea1d21d94b50eb61543f5b9478e274343d7367ccd3c62c645861c03089550c85fdd92df61dd94bd79381757521a9ea45d68
SSDEEP

196608:Q48PIdLjv+bhqNVoB0SEsucQZ41JBbIM11tR:z8PIlL+9qz80SJHQK1Jx1vR

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2656	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/files/0x00050000000196a0-21.dat	upx
behavioral3/memory/2656-23-0x000007FEF5BC0000-0x000007FEF61AE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2656	2624	Built.exe	30
PID 2624 wrote to memory of 2656	2624	Built.exe	30
PID 2624 wrote to memory of 2656	2624	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2656

C:\Users\Admin\AppData\Local\Temp\_MEI26242\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
memory/2656-23-0x000007FEF5BC0000-0x000007FEF61AE000-memory.dmp

Filesize
5.9MB

Download