8aab473bdf4b87d3a39e53f6aaef7e8bf912c70318b871a743eb2913b270c5c2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 15:58

Target

main.exe
Size

17.8MB
MD5

e976774abd2ffd1f447082cf46a5d489
SHA1

8f14716ed5ea607af724b21dcf12efcbaa6a8344
SHA256

8aab473bdf4b87d3a39e53f6aaef7e8bf912c70318b871a743eb2913b270c5c2
SHA512

dc7f501bdf329cc452517d6d4bcce9b2d1d72934a6191d10e54fb9538a1a8f44570109e83c71f3942f3f648e6de66f91d881d2a77401e24006419c25e95683cd
SSDEEP

393216:lRqPnLFXlriQ8DOETgsvfGFpg7F1btYsEvEuXuEu27eq:CPLFXNiQhE4KttYs9eLui

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2112	main.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4e2-111.dat	upx
behavioral1/memory/2112-113-0x000007FEF6480000-0x000007FEF68EE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2112	1400	main.exe	31
PID 1400 wrote to memory of 2112	1400	main.exe	31
PID 1400 wrote to memory of 2112	1400	main.exe	31

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  PID:2112

C:\Users\Admin\AppData\Local\Temp\_MEI14002\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
memory/2112-113-0x000007FEF6480000-0x000007FEF68EE000-memory.dmp

Filesize
4.4MB

Download