ed35cd71a41b1c778d7ce6e4df16db7099fdb207ff29178d5a044b21325500c8

Resubmissions

28/08/2024, 13:13

28/08/2024, 12:44

02/07/2024, 07:28

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 12:44

Target

source_prepared.exe
Size

75.7MB
MD5

59a214c843b1a5296582aa8fc913d9c9
SHA1

5bd273f0745394e1001ab1fe1d60f5b1c3f02ea5
SHA256

ed35cd71a41b1c778d7ce6e4df16db7099fdb207ff29178d5a044b21325500c8
SHA512

cb8b0a6839b480b38d770d780712afcf3a86cad91b467f357d9d0dddc664394dc9c2553545ed35ef7815ccc90d634cc10242de7e79a30e8a021836e0d0dc21bb
SSDEEP

1572864:EHcRltSk8IpG7V+VPhqYdfME7FFlHFziYweyJulZUdgAdW4OjKux31/Z9U:EHcRnSkB05awcfhdCpukdRaDN9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2760	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001cca8-1211.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2760	2416	source_prepared.exe	30
PID 2416 wrote to memory of 2760	2416	source_prepared.exe	30
PID 2416 wrote to memory of 2760	2416	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2760

C:\Users\Admin\AppData\Local\Temp\_MEI24162\python312.dll

Filesize
1.7MB

MD5
506c760a20e6bb940590229d41449ffa

SHA1
b7c439f253987fb0ff66fc5ce959cf711b18eb8d

SHA256
e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5

SHA512
34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e

Download Submit
memory/2760-1213-0x000007FEF5510000-0x000007FEF5BD4000-memory.dmp

Filesize
6.8MB

Download