00ddd17fc113fcca57da61267e5cb8b762db0675aaf4afa7f7870c2474b39e05

Resubmissions

23/08/2024, 13:45

23/08/2024, 12:27

max time kernel
12s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 12:27

Target
Windinject.exe
Size 79.0MB
Sample240823-pmq6wstdmh
SHA256 00ddd17fc113fcca57da61267e5cb8b762db0675aaf4afa7f7870c2474b39e05
MD5 6167f9f62a50b89b5d1d980039bbc387
SHA1 185cee450e86be4b4b97642109bf4ecbf0411929
SHA512 c8b881429819039a4385d0a96ed703604ed402247dd6d8229d0a0b9a267aeff4d19b21a86bf4d86a042f53eb6e232e54f82e6e621bf8a0230e0119872821b96f
SSDEEP 1572864:XvxZQglV3mWMSk8IpG7V+VPhqCMNE7TlgHtqiYgj+h58sMwt9z81cJzi:XvxZxfWhSkB05awCMkeNE5R9zni
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
276	Windinject.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00030000000209fc-1251.dat	upx
behavioral1/memory/276-1253-0x000007FEF6100000-0x000007FEF66E9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 276	2976	Windinject.exe	31
PID 2976 wrote to memory of 276	2976	Windinject.exe	31
PID 2976 wrote to memory of 276	2976	Windinject.exe	31

C:\Users\Admin\AppData\Local\Temp\Windinject.exe
"C:\Users\Admin\AppData\Local\Temp\Windinject.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\Windinject.exe
  "C:\Users\Admin\AppData\Local\Temp\Windinject.exe"
  2⤵
  - Loads dropped DLL
  PID:276

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29762\python311.dll
Size 1.6MB
SHA256 286483910be593ce685c0377463aa3250528fa22a08e1d38e831659ed81f12c1
MD5 ffd85743633296368dcc81c9ff0e8554
SHA1 ccf28c70bbf853dbd6cd258f59836f25774f1c34
SHA512 65b9baaf31abd0a71571c6567290fea86b986c6dba2f747cd24158226ef4a32af37ccf4ea461658c5822fda9de1525d8f4e19ed473c349c6d2db664d8d4c2b07
SSDEEP 49152:LHqk+Tq+DBrHf06FQAXUtzI0XTLe0EJNgZAem/Y:jOqCTfXjei0EJNlen
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/276-1253-0x000007FEF6100000-0x000007FEF66E9000-memory.dmp

Download