28f86d1485d28aead2165497ffe749b56d433007a8fe4e80916408b05bfc66f6

Analysis

max time kernel
241s
max time network
252s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 21:37

Target

Launcher_v0.876 beta.exe
Size

75.4MB
MD5

be2a85fc60c15682bd64055f1222c59e
SHA1

0223e9103c63b9a7ea84121871f7fd823905f95e
SHA256

6ac60acecec3832cbcdf8c593489e394619a433da7806ad0f29aa6e618078c2f
SHA512

358ce8869f4d334501cf35d2f4451c335d7976ec615503c1e0cc117054e1cbba0db42e7e55ae909fa62ba89e13856dddf1d262c275979c0da9009337a2bdb282
SSDEEP

1572864:wvhQ6l777vDSk8IpG7V+VPhqWK8pE7WTDlPNiY4MHHLeqPNLtDSHWzZp1+K:wvh1JPSkB05awWK8TTD5CMHVLtOa9r

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2924	Launcher_v0.876 beta.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000300000001cfe7-1260.dat	upx
behavioral1/memory/2924-1262-0x000007FEF5BC0000-0x000007FEF6026000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2924	2884	Launcher_v0.876 beta.exe	29
PID 2884 wrote to memory of 2924	2884	Launcher_v0.876 beta.exe	29
PID 2884 wrote to memory of 2924	2884	Launcher_v0.876 beta.exe	29

C:\Users\Admin\AppData\Local\Temp\Launcher_v0.876 beta.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher_v0.876 beta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\Launcher_v0.876 beta.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher_v0.876 beta.exe"
  2⤵
  - Loads dropped DLL
  PID:2924

C:\Users\Admin\AppData\Local\Temp\_MEI28842\python310.dll

Filesize
1.4MB

MD5
b805cebb0242b3bbfe810a19c2b44e3d

SHA1
62d71b686b64e6efd58852a5e59f4b00cec18f30

SHA256
2d2d5746d6a066fcc3e7b8c041ffb7c7722c14b148aed923387dbacc951d732b

SHA512
d46a5b3274aed182d30647d461d1dc7bd2599a43b1914d5a5e882c4298ecf4f11c64272db351257f836806ae55d5f1a0c1369f4159df09c8d7aea9a52d2e1acd

Download Submit
memory/2924-1262-0x000007FEF5BC0000-0x000007FEF6026000-memory.dmp

Filesize
4.4MB

Download