55d325d8c0d2d3007c8caa12a95a182df5e6bc5d16e883e521d2be419697753a

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 22:15

Target

BootstrapperV1.18.exe
Size

7.5MB
MD5

aa78613995bf051cd79ad8ed3460e20d
SHA1

64b34e360c62ac4d8ea2a7f3c5421d320afc5563
SHA256

55d325d8c0d2d3007c8caa12a95a182df5e6bc5d16e883e521d2be419697753a
SHA512

7814af9f79ab9f2291768988e815daa9480021d4d5fd4c14523f4ef0172018e86aff0717155871f806883f966efec92fb3b656db23eb7ae90aa72b7f9a9b5421
SSDEEP

196608:MYgWWwfI9jUC2gYBYv3vbW2GPFQwW+HlmiEy:eWdIH2gYBgDWrQwtlb

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1720	BootstrapperV1.18.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016de0-21.dat	upx
behavioral1/memory/1720-23-0x000007FEF5420000-0x000007FEF5AE5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1720	2516	BootstrapperV1.18.exe	30
PID 2516 wrote to memory of 1720	2516	BootstrapperV1.18.exe	30
PID 2516 wrote to memory of 1720	2516	BootstrapperV1.18.exe	30

C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe"
  2⤵
  - Loads dropped DLL
  PID:1720

C:\Users\Admin\AppData\Local\Temp\_MEI25162\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/1720-23-0x000007FEF5420000-0x000007FEF5AE5000-memory.dmp

Filesize
6.8MB

Download