9667cca7787a34a124a56f11862e2edddf3c0552caabfdb3f315639fcc883f50

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 00:05

Target

testing.exe
Size

7.5MB
MD5

2f60848cc614f7c6f034341870d04d4c
SHA1

00e2e316b97642b3af475db64673501840ad8a20
SHA256

c1a6adeaf1738774661da107247a759047625f989f5ef62d9bc919abe38b4f40
SHA512

a074973f14eafec9fabb4db8f97f55015baa1470bb6c431fdbd6db0cc535d3a7717720525ea3fe8d0f9ba032383e79e10e766c4b071a8b4d247cbbc35d518be1
SSDEEP

196608:GcgVVEQqwfI9jUC2gYBYv3vbW2+iITx1U6nO:sVVEQ5IH2gYBgDWJTnzO

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
456	testing.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018eba-21.dat	upx
behavioral1/memory/456-23-0x000007FEF5600000-0x000007FEF5CC5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 456	1960	testing.exe	31
PID 1960 wrote to memory of 456	1960	testing.exe	31
PID 1960 wrote to memory of 456	1960	testing.exe	31

C:\Users\Admin\AppData\Local\Temp\testing.exe
"C:\Users\Admin\AppData\Local\Temp\testing.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\testing.exe
  "C:\Users\Admin\AppData\Local\Temp\testing.exe"
  2⤵
  - Loads dropped DLL
  PID:456

C:\Users\Admin\AppData\Local\Temp\_MEI19602\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/456-23-0x000007FEF5600000-0x000007FEF5CC5000-memory.dmp

Filesize
6.8MB

Download