02ab5eaa36cd584cb56f5f384d9a3c6e1cb19620c8e23e72d72097c023c93372

Analysis

max time kernel
8s
max time network
6s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 03:04

Target

VXLauncher.exe
Size

56.1MB
MD5

86480d87daa6bdcc81fc5fa224ae47a4
SHA1

86685b537b073b4fa43503b64ce9dbdd402d3033
SHA256

02ab5eaa36cd584cb56f5f384d9a3c6e1cb19620c8e23e72d72097c023c93372
SHA512

ec0743f111dc144023a7f3e6bb01123144c5a81601ae31fab6765edcf6f08a9b1c5ff58887408943097381fd826129bed6d2ed49dc29c0dd558220bc3b808b88
SSDEEP

1572864:AvxZQglHWE7vaSk8IpG7V+VPhqQdSiE70lg7SDPz:AvxZxF3eSkB05awkSge7gb

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

VXLauncher.exe

pid process

2600 VXLauncher.exe

pid	process
2600	VXLauncher.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI25602\python311.dll	upx
behavioral1/memory/2600-1161-0x000007FEF6880000-0x000007FEF6E72000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

VXLauncher.exe

description	pid	process	target process
PID 2560 wrote to memory of 2600	2560	VXLauncher.exe	VXLauncher.exe
PID 2560 wrote to memory of 2600	2560	VXLauncher.exe	VXLauncher.exe
PID 2560 wrote to memory of 2600	2560	VXLauncher.exe	VXLauncher.exe

C:\Users\Admin\AppData\Local\Temp\VXLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\VXLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\VXLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\VXLauncher.exe"
  2⤵
  - Loads dropped DLL
  PID:2600

C:\Users\Admin\AppData\Local\Temp\_MEI25602\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2600-1161-0x000007FEF6880000-0x000007FEF6E72000-memory.dmp

Filesize
5.9MB

Download