8caaad73fde7729f69f2b1eac55aaf7f3b04a5a16e6043eeeb1c4d13539979dc

Analysis

max time kernel
8s
max time network
1s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 12:39

Target

source_prepared.exe
Size

38.9MB
MD5

1958d56ce89570d458ad70e205129d90
SHA1

366cc40327d36b79531e0df984c86a79b1c51858
SHA256

8caaad73fde7729f69f2b1eac55aaf7f3b04a5a16e6043eeeb1c4d13539979dc
SHA512

0afe2380faf8527bad4c2fa42210de99a69fa6e0e2b082e669b959629b3cea6aa41769244576b3a5e370432bbf13dfe43a90e9eec2ec9419687b9dcb20dfc663
SSDEEP

786432:u9Z9xbdQglp8+W8YM67vD7laO45zcY87HC5QlstXcWSK9v9UlQxrP:wvxZQgl3WLp7vwPE7hlgB9lUmr

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2380	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a1f-1157.dat	upx
behavioral1/memory/2380-1159-0x000007FEF6010000-0x000007FEF65F9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2380	2516	source_prepared.exe	30
PID 2516 wrote to memory of 2380	2516	source_prepared.exe	30
PID 2516 wrote to memory of 2380	2516	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2380

C:\Users\Admin\AppData\Local\Temp\_MEI25162\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/2380-1159-0x000007FEF6010000-0x000007FEF65F9000-memory.dmp

Filesize
5.9MB

Download