2cf23d3c7c672cd7eb6cf202938221f85516dfcf28543e8ac3aa08064920edab

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 23:12

Target

Loader.exe
Size

11.3MB
MD5

66ec737afe283e53ad64c9cda9e920e7
SHA1

ac8ce4b38e8be27b652d4805da531f78bcf9b1d2
SHA256

2cf23d3c7c672cd7eb6cf202938221f85516dfcf28543e8ac3aa08064920edab
SHA512

d85bb8db13f55c655d30213c925ac6a767b3e852d7131960783fefd9dbf05f428b5878c3dee4c1d66fb6e8c154b8d50b39f595f0a179a07172804ba61978842b
SSDEEP

196608:94QbiRW39V0Jb3tQk5tAurErvI9pWj+NyPvzmespEcAIsTOg9FkCH:yQuRWtu7v5tAurEUWjuy3zafeTOg9Fk8

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2952	Loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c5b-40.dat	upx
behavioral1/memory/2952-42-0x000007FEF5B70000-0x000007FEF6162000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2952	Loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2952	2948	Loader.exe	30
PID 2948 wrote to memory of 2952	2948	Loader.exe	30
PID 2948 wrote to memory of 2952	2948	Loader.exe	30

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2952

C:\Users\Admin\AppData\Local\Temp\_MEI29482\python311.dll

Filesize
1.6MB

MD5
0d96f5dfd2dd0f495cad36148493c761

SHA1
928107e88bbee02563594374cd6c6ad19091fe14

SHA256
a238f7fb0043c4b64f76095c1ef950544bb1d0debd0902ea0fa3e8d99e5d4a47

SHA512
693c28c64e974ca1fb754357788a65b3a0271e63395963bb92691a5838e1b665af7aada6be5c5ada8339100eedd64c40ca0556601bec26a0f9e483ea98ab2d03

Download Submit
memory/2952-42-0x000007FEF5B70000-0x000007FEF6162000-memory.dmp

Filesize
5.9MB

Download
memory/2952-43-0x000007FEF5B70000-0x000007FEF6162000-memory.dmp

Filesize
5.9MB

Download