3b5869397c4daaf4badca0590254e90e09d3e25373524d2952ae815432b35338

Resubmissions

22/08/2024, 01:53

22/08/2024, 01:52

22/08/2024, 01:48

max time kernel
1559s
max time network
1560s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 01:48

Target

BootstrapperV1.16.exe
Size

7.5MB
MD5

d07874e5e697293369d47f6727787711
SHA1

50b44591caf4de65d9abf7b6c9b4e1b3ffab549e
SHA256

3b5869397c4daaf4badca0590254e90e09d3e25373524d2952ae815432b35338
SHA512

2aff151b97d1928375f02175e28dcc24fc293fdfa0f44fa3b5a114914c378fce54af54bd96802063470b10ede717715547488c9695e8e33990a51043b375643e
SSDEEP

196608:mHhByurErvI9pWjg/Qc+4o673pNrabewyzWGPMYnN9s:KyurEUWjZZ4dDLIeTzWGPTNC

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1908	BootstrapperV1.16.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a423-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1908	2076	BootstrapperV1.16.exe	30
PID 2076 wrote to memory of 1908	2076	BootstrapperV1.16.exe	30
PID 2076 wrote to memory of 1908	2076	BootstrapperV1.16.exe	30

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.16.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.16.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.16.exe"
  2⤵
  - Loads dropped DLL
  PID:1908

C:\Users\Admin\AppData\Local\Temp\_MEI20762\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/1908-23-0x000007FEF5C00000-0x000007FEF62C5000-memory.dmp

Filesize
6.8MB

Download