2c554758c8c01d147e940e6a4cbd6ee44e0d8fe22351938df800d2d76bd45f7d

Analysis

max time kernel
73s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 00:05

Target

Release/loader.exe
Size

6.5MB
MD5

5640e7c7fbbfa0134b74865a6d4737ea
SHA1

82cb4c4440e9e3baab6b75994d94041e66830b3c
SHA256

55ec88ada55c35967781c12ac60757e8e8f6257357cf5508cf17eca7a8acc123
SHA512

3acea538d5910aee2faa1c954e927eefa9c606eb35637072e3f06601c5fe91cf95e8d3ca176ae5ecec8b1a1f017da867408a29b0a9e0d4c47085d439ce8a1342
SSDEEP

196608:AMNTPY7QEbGXqEICteEroXGzlxZV3Gu5D4S26/CS32uTdq:BYkEhEInEroXC14S26Wuxq

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2640	loader.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/memory/2840-0-0x000000013FB20000-0x000000013FB9D000-memory.dmp	upx
behavioral3/memory/2640-15-0x000000013FB20000-0x000000013FB9D000-memory.dmp	upx
behavioral3/memory/2640-19-0x000000013FB20000-0x000000013FB9D000-memory.dmp	upx
behavioral3/memory/2840-33-0x000000013FB20000-0x000000013FB9D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2640	2840	loader.exe	31
PID 2840 wrote to memory of 2640	2840	loader.exe	31
PID 2840 wrote to memory of 2640	2840	loader.exe	31

C:\Users\Admin\AppData\Local\Temp\Release\loader.exe
"C:\Users\Admin\AppData\Local\Temp\Release\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\Release\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Release\loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2640

C:\Users\Admin\AppData\Local\Temp\_MEI28402\python310.dll

Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit
memory/2640-15-0x000000013FB20000-0x000000013FB9D000-memory.dmp

Filesize
500KB

Download
memory/2640-19-0x000000013FB20000-0x000000013FB9D000-memory.dmp

Filesize
500KB

Download
memory/2840-0-0x000000013FB20000-0x000000013FB9D000-memory.dmp

Filesize
500KB

Download
memory/2840-33-0x000000013FB20000-0x000000013FB9D000-memory.dmp

Filesize
500KB

Download