699397f368c56fe08f4002eae2ceb98cc3b5a82151516d6cab2dc5315495a3e2

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 12:17

Target

uploader.exe
Size

9.1MB
MD5

e2deb4f97fef7226ba5a6963d29ef49f
SHA1

f0c03f217e99ea965711a5f030e2d197fa74b766
SHA256

699397f368c56fe08f4002eae2ceb98cc3b5a82151516d6cab2dc5315495a3e2
SHA512

a11e1c4a4986475184d1e36da9ad51ef564c74fb58ebe92ab971c7fd4c9d5802e87df2c55a934681481481cf482896e79c667f702ed6fc83c1f8905f5160373e
SSDEEP

196608:sxQyqwJ/TLx4hz7DIxynurErvI9pWj04Qc+4o673pNqljxaMDHdm4:UWKTGz7kMurEUWjEZ4dDKfamd

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2900	uploader.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1080-0-0x000000013FB40000-0x000000013FBAC000-memory.dmp	upx
behavioral2/files/0x0006000000018c31-28.dat	upx
behavioral2/memory/2900-30-0x000007FEF6400000-0x000007FEF6AC5000-memory.dmp	upx
behavioral2/memory/2900-31-0x000000013FB40000-0x000000013FBAC000-memory.dmp	upx
behavioral2/memory/1080-58-0x000000013FB40000-0x000000013FBAC000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2900	1080	uploader.exe	31
PID 1080 wrote to memory of 2900	1080	uploader.exe	31
PID 1080 wrote to memory of 2900	1080	uploader.exe	31

C:\Users\Admin\AppData\Local\Temp\uploader.exe
"C:\Users\Admin\AppData\Local\Temp\uploader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\uploader.exe
  "C:\Users\Admin\AppData\Local\Temp\uploader.exe"
  2⤵
  - Loads dropped DLL
  PID:2900

C:\Users\Admin\AppData\Local\Temp\_MEI10802\python312.dll

Filesize
1.7MB

MD5
ca67f0baf3cc3b7dbb545cda57ba3d81

SHA1
5b4e36aef877307af8a8f78f3054d068d1a9ce89

SHA256
f804ed205e82003da6021ee6d2270733ca00992816e7e89ba13617c96dd0fba3

SHA512
a9f07dd02714c3efba436326425d443969018ace7ebd7cc33c39d43e3d45480a4fcd4c46c09ad132b4f273888f13e9f598de257130429fcb2519c000e4fab6f7

Download Submit
memory/1080-0-0x000000013FB40000-0x000000013FBAC000-memory.dmp

Filesize
432KB

Download
memory/1080-58-0x000000013FB40000-0x000000013FBAC000-memory.dmp

Filesize
432KB

Download
memory/2900-30-0x000007FEF6400000-0x000007FEF6AC5000-memory.dmp

Filesize
6.8MB

Download
memory/2900-31-0x000000013FB40000-0x000000013FBAC000-memory.dmp

Filesize
432KB

Download