8caaad73fde7729f69f2b1eac55aaf7f3b04a5a16e6043eeeb1c4d13539979dc

Analysis

max time kernel
26s
max time network
34s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 21:58

Target

source_prepared.exe
Size

38.9MB
MD5

1958d56ce89570d458ad70e205129d90
SHA1

366cc40327d36b79531e0df984c86a79b1c51858
SHA256

8caaad73fde7729f69f2b1eac55aaf7f3b04a5a16e6043eeeb1c4d13539979dc
SHA512

0afe2380faf8527bad4c2fa42210de99a69fa6e0e2b082e669b959629b3cea6aa41769244576b3a5e370432bbf13dfe43a90e9eec2ec9419687b9dcb20dfc663
SSDEEP

786432:u9Z9xbdQglp8+W8YM67vD7laO45zcY87HC5QlstXcWSK9v9UlQxrP:wvxZQgl3WLp7vwPE7hlgB9lUmr

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2236	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000300000001e7db-1157.dat	upx
behavioral1/memory/2236-1159-0x000007FEF5980000-0x000007FEF5F69000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2896	AUDIODG.EXE
Token: 33	2896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2896	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2236	2532	source_prepared.exe	29
PID 2532 wrote to memory of 2236	2532	source_prepared.exe	29
PID 2532 wrote to memory of 2236	2532	source_prepared.exe	29

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2236

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x598
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Users\Admin\AppData\Local\Temp\_MEI25322\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/2236-1159-0x000007FEF5980000-0x000007FEF5F69000-memory.dmp

Filesize
5.9MB

Download