9dce1fd1117f165255190bdb5758fbfbc450c904a4d82343b2c3e8c462dc59ec

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 20:39

Target

gameinstaller.exe
Size

58.2MB
MD5

01446ffd8cccb33f5b8b6d57decf0f86
SHA1

225a982d2ea459af6560d5b9075597fb03a5f49a
SHA256

9dce1fd1117f165255190bdb5758fbfbc450c904a4d82343b2c3e8c462dc59ec
SHA512

cdb62c17516e34d0273e6730f9c4b58c7fbb3100c7d47bbe97cf80f3dffbe71e34a487f510238b80f63ca8a2a8a2d764637f38756ec6b0f1d18f6e69996eec25
SSDEEP

1572864:uAOQQRI7vFQqMrlpA+Ql4/+KvIxlqNICLLF:uAOb6JyklM+KvAyhLF

Score

7^/10

upx

Loads dropped DLL 2 IoCs

pid	Process
2764	gameinstaller.exe
2764	gameinstaller.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020912-749.dat	upx
behavioral1/memory/2764-751-0x000007FEF5CB0000-0x000007FEF6299000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2764	2632	gameinstaller.exe	31
PID 2632 wrote to memory of 2764	2632	gameinstaller.exe	31
PID 2632 wrote to memory of 2764	2632	gameinstaller.exe	31

C:\Users\Admin\AppData\Local\Temp\gameinstaller.exe
"C:\Users\Admin\AppData\Local\Temp\gameinstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\gameinstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\gameinstaller.exe"
  2⤵
  - Loads dropped DLL
  PID:2764

C:\Users\Admin\AppData\Local\Temp\_MEI26322\python311.dll

Filesize
1.6MB

MD5
ac6cc302aa9e58ec53b56b9f2786de40

SHA1
1375c081b7c920ee267002bc153ff3b80c07187e

SHA256
2f48c4d1ad846f7617e886cbdc88154d17464be0eabc5fa9db81cead0d157056

SHA512
9bdfe7ebca2d01fdba940e646418579abc8fdccea7e772f3e98eef5f6d4743ebda0796ad7356a29f3472149b5468758600e5d2e3eaaa53a737771effc3d6fcb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26322\ucrtbase.dll

Filesize
1021KB

MD5
4e326feeb3ebf1e3eb21eeb224345727

SHA1
f156a272dbc6695cc170b6091ef8cd41db7ba040

SHA256
3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9

SHA512
be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

Download Submit
memory/2764-751-0x000007FEF5CB0000-0x000007FEF6299000-memory.dmp

Filesize
5.9MB

Download