58a005dae0f8e4665c7262c45fbe99a775b06e384a11d86371187e5b8c47f313

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 18:58

Target

Vape.exe
Size

5.8MB
MD5

8cfd471e70105ed5968a6e06d981a68f
SHA1

82404cb4d8ea53b922d1cdbc988f17860b735f9e
SHA256

05b1092ed811c5825cb29b66ae20830d14b596f1ed3b07e18b9820a0f5f2a872
SHA512

3a5f2cf5630c7845357f89b8d209db52e83018a8a32944f5e6ad82be530c5c70619d4dddf2d4d918318240309421b08ce57e790f623298eaeff4123031a7114c
SSDEEP

98304:QumDSr7vcRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nNet3I:QumD6vcRHvUWvozWOxu9kXwvdbDlA033

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2764	Vape.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000186e4-21.dat	upx
behavioral1/memory/2764-23-0x000007FEF6250000-0x000007FEF66BA000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2764	2956	Vape.exe	31
PID 2956 wrote to memory of 2764	2956	Vape.exe	31
PID 2956 wrote to memory of 2764	2956	Vape.exe	31

C:\Users\Admin\AppData\Local\Temp\Vape.exe
"C:\Users\Admin\AppData\Local\Temp\Vape.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\Vape.exe
  "C:\Users\Admin\AppData\Local\Temp\Vape.exe"
  2⤵
  - Loads dropped DLL
  PID:2764

C:\Users\Admin\AppData\Local\Temp\_MEI29562\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/2764-23-0x000007FEF6250000-0x000007FEF66BA000-memory.dmp

Filesize
4.4MB

Download