94336ccbc2bf47d3d53813a6a84ba5eba80f8f5d10cb145d8cf99e50e737a471

Analysis

max time kernel
8s
max time network
8s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 19:16

Target

X_STOP_SKIDDING.exe
Size

80.5MB
MD5

d4a4271250b540003b349e43a0d26f4c
SHA1

3bc7799e2ffb7588742633359b8cf35209bb4e76
SHA256

94336ccbc2bf47d3d53813a6a84ba5eba80f8f5d10cb145d8cf99e50e737a471
SHA512

452afb91a5177915721d117637d7da530b16e8ce94849f9e249af88cf671596b565eb1c1971af5f9ae5f78a3e936c469a87f5e9dd146506f91551365dfa614da
SSDEEP

1572864:vvxZQglwWLvZSk8IpG7V+VPhqclE7hlgkiYgj+h58sMw091b4cJzU:vvxZxqGZSkB05awcYeu5Y91bU

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3032	X_STOP_SKIDDING.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a94-1260.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3032	1964	X_STOP_SKIDDING.exe	30
PID 1964 wrote to memory of 3032	1964	X_STOP_SKIDDING.exe	30
PID 1964 wrote to memory of 3032	1964	X_STOP_SKIDDING.exe	30

C:\Users\Admin\AppData\Local\Temp\X_STOP_SKIDDING.exe
"C:\Users\Admin\AppData\Local\Temp\X_STOP_SKIDDING.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\X_STOP_SKIDDING.exe
  "C:\Users\Admin\AppData\Local\Temp\X_STOP_SKIDDING.exe"
  2⤵
  - Loads dropped DLL
  PID:3032

C:\Users\Admin\AppData\Local\Temp\_MEI19642\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/3032-1262-0x000007FEF57E0000-0x000007FEF5DC9000-memory.dmp

Filesize
5.9MB

Download