1c6348aa17516ebe447ffa26013f35242a6e2f8479d6c247bfbbc8d542fb75da

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 16:53

Target

boost.exe
Size

7.5MB
MD5

bee5ee8fa4024751c2f10410b38a2099
SHA1

87f4594273dcd8fae82df4b5c3a6f931dcd33bc2
SHA256

3a8f848441b699574acc5c968290f6ab925901edadeb28542d6d4b893f0d8a1e
SHA512

c789ddf4b83d5be250cce251a7b31a120573a192df50bf95dcc0ee17fc6c6129ac3fb28d25f6ea9788c0367c264967f5f34a130c7c1b0508e470d0058ea9fd41
SSDEEP

196608:/VgVVEmwfI9jUC2gYBYv3vbW2+iITx1U6n3:OVVENIH2gYBgDWJTnz3

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2380	boost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/files/0x0005000000018f80-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2380	904	boost.exe	29
PID 904 wrote to memory of 2380	904	boost.exe	29
PID 904 wrote to memory of 2380	904	boost.exe	29

C:\Users\Admin\AppData\Local\Temp\boost.exe
"C:\Users\Admin\AppData\Local\Temp\boost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\boost.exe
  "C:\Users\Admin\AppData\Local\Temp\boost.exe"
  2⤵
  - Loads dropped DLL
  PID:2380

C:\Users\Admin\AppData\Local\Temp\_MEI9042\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2380-23-0x000007FEF6270000-0x000007FEF6935000-memory.dmp

Filesize
6.8MB

Download