a023a188c3d5a7ed144c4ceb444b8f0fe29f3693db9dee8439d920cf12deaac4

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 13:56

Target

UA Loader (1).exe
Size

19.5MB
MD5

80418cfe69672a2eff86a9b5e223b73a
SHA1

99c6de593b6be0f6a821c0e68935ffb35038f10c
SHA256

a023a188c3d5a7ed144c4ceb444b8f0fe29f3693db9dee8439d920cf12deaac4
SHA512

85c8f0999628e376d3148d0b3999476efb7d0526322affb3c40e1013ee84c60ed7d098dbdead262aba2cc4735e41de9987037b64503ffdcd900b4b7904bc52d5
SSDEEP

196608:ggEIbLJdPY71DkTeNrYFJMIDJ+gsAGKpR5NQmDjoS6ygWNh2:Nf3c1b8Fqy+gsi57Yr

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2660	UA Loader (1).exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a410-45.dat	upx
behavioral1/memory/2660-47-0x000007FEF6040000-0x000007FEF64AE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 2660	580	UA Loader (1).exe	31
PID 580 wrote to memory of 2660	580	UA Loader (1).exe	31
PID 580 wrote to memory of 2660	580	UA Loader (1).exe	31

C:\Users\Admin\AppData\Local\Temp\UA Loader (1).exe
"C:\Users\Admin\AppData\Local\Temp\UA Loader (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\AppData\Local\Temp\UA Loader (1).exe
  "C:\Users\Admin\AppData\Local\Temp\UA Loader (1).exe"
  2⤵
  - Loads dropped DLL
  PID:2660

C:\Users\Admin\AppData\Local\Temp\_MEI5802\python310.dll

Filesize
1.4MB

MD5
196deb9a74e6e9e242f04008ea80f7d3

SHA1
a54373ebad306f3e6f585bcdf1544fbdcf9c0386

SHA256
20b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75

SHA512
8c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68

Download Submit
memory/2660-47-0x000007FEF6040000-0x000007FEF64AE000-memory.dmp

Filesize
4.4MB

Download