0dde24970994a708a737b05127a7881c7d9a49eb23a9a1697fa9be7329a9c993

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 19:33

Target

Neverlose.exe
Size

5.9MB
MD5

07aa0ef64cdaea07aa2114bd0c9e3548
SHA1

a4ae0005d3bd954c9f8a5db7e79d43ecc4b049c1
SHA256

8ea71b405dab1fafd460195d39d652b56306313cd465aa17492f00afd7696f59
SHA512

d791fb54d5ac98b7c498ac2b0c18493ba24c6b2890bb587c518d5df0df423da62f4f89f28cd4bfb8a65bd46ffd2b25cdcc97880d6b8b63e497226fd2b7373a7d
SSDEEP

98304:8g+WCHTTZi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFq9hCkrM0nS:8zr/7DOYjJlpZstQoS9Hf12VKX5bCChy

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1620	Neverlose.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019277-21.dat	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1620	Neverlose.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1620	1616	Neverlose.exe	30
PID 1616 wrote to memory of 1620	1616	Neverlose.exe	30
PID 1616 wrote to memory of 1620	1616	Neverlose.exe	30

C:\Users\Admin\AppData\Local\Temp\Neverlose.exe
"C:\Users\Admin\AppData\Local\Temp\Neverlose.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\Neverlose.exe
  "C:\Users\Admin\AppData\Local\Temp\Neverlose.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1620

C:\Users\Admin\AppData\Local\Temp\_MEI16162\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/1620-23-0x000007FEF6AB0000-0x000007FEF6F15000-memory.dmp

Filesize
4.4MB

Download
memory/1620-24-0x000007FEF6AB0000-0x000007FEF6F15000-memory.dmp

Filesize
4.4MB

Download