a02c6673d87414ead1acbcbf6e902716983e86b7ee86ec7e858d8e082faa0662

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 01:39

Target

source_prepared.exe
Size

80.9MB
MD5

bab90fb406091f997154ad23d33cc14f
SHA1

c208f2394999db000e44e2bbf87b6805376efc52
SHA256

a02c6673d87414ead1acbcbf6e902716983e86b7ee86ec7e858d8e082faa0662
SHA512

dc65221a56a31aa6d98ebd4a3ab4bd5e93ef0ae77016be8fa51d84ed2ba250b4678c7871dda6949e45eb32e733a8dac0e8f114918515f27765ab30b4e180cf4d
SSDEEP

1572864:IvxZQglnWU7vaSk8IpG7V+VPhqYdfCE70lgLiYgj+h58sMw74DP+wJk:IvxZx95eSkB05awcfAeF53CK

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2728	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a69-1260.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2728	2536	source_prepared.exe	30
PID 2536 wrote to memory of 2728	2536	source_prepared.exe	30
PID 2536 wrote to memory of 2728	2536	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2728

C:\Users\Admin\AppData\Local\Temp\_MEI25362\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/2728-1262-0x000007FEF5AB0000-0x000007FEF60A2000-memory.dmp

Filesize
5.9MB

Download