57c8cf68f41a31f229822852043acfd80f8d64f72b47a32caacb4a457d880356

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 19:35

Target

VxrusHisVirus.exe
Size

7.5MB
MD5

6110ef13b9ac28d2db493cc9e9a8d877
SHA1

046208f499a506d0bd29a868e3efec7a88fc3430
SHA256

57c8cf68f41a31f229822852043acfd80f8d64f72b47a32caacb4a457d880356
SHA512

4c94dbef75681c7491118fcad8d440a295ba35802f3606b1c37563ad4c505edf820379a8230f60a8676fa21e9c474a26e2638ac6526430b1ca1513fec5db3d48
SSDEEP

196608:IzgVVEbpVwfI9jUC2gYBYv3vbW2+iITx1U6ny:LVVEsIH2gYBgDWJTnzy

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1484	VxrusHisVirus.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a48d-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1484	2688	VxrusHisVirus.exe	31
PID 2688 wrote to memory of 1484	2688	VxrusHisVirus.exe	31
PID 2688 wrote to memory of 1484	2688	VxrusHisVirus.exe	31

C:\Users\Admin\AppData\Local\Temp\VxrusHisVirus.exe
"C:\Users\Admin\AppData\Local\Temp\VxrusHisVirus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\VxrusHisVirus.exe
  "C:\Users\Admin\AppData\Local\Temp\VxrusHisVirus.exe"
  2⤵
  - Loads dropped DLL
  PID:1484

C:\Users\Admin\AppData\Local\Temp\_MEI26882\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/1484-23-0x000007FEF60E0000-0x000007FEF67A5000-memory.dmp

Filesize
6.8MB

Download