4c1b3c835bd60d28f703c1fc21c4b49ab8c530c4c13ddd125b97c3a23fc0bd4d

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 17:46

Target

Wave-Generator-App.exe
Size

11.4MB
MD5

6adfabca30811868e167bcb02da7276a
SHA1

b22b42a7987fe79b1b068801f85fa07a522e0d0c
SHA256

4c1b3c835bd60d28f703c1fc21c4b49ab8c530c4c13ddd125b97c3a23fc0bd4d
SHA512

50677d0ea7750ba40c9cf1e4680260c2871d8ff397c3264c2c902a313e7829f02292d666fa2186f5c16f19bccc996d495da41d009a32d9d7a7f1888742e8de5a
SSDEEP

196608:L03MDhGreGJb3tQk5tSOshoKMuIkhVAastRL5DicJUGc1K7kC8Gx:4YhGL7v5tSOshouIkPAftRL5dYY8Gx

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2720	Wave-Generator-App.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019543-51.dat	upx
behavioral1/memory/2720-53-0x000007FEF59F0000-0x000007FEF5FD9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2720	2448	Wave-Generator-App.exe	31
PID 2448 wrote to memory of 2720	2448	Wave-Generator-App.exe	31
PID 2448 wrote to memory of 2720	2448	Wave-Generator-App.exe	31

C:\Users\Admin\AppData\Local\Temp\Wave-Generator-App.exe
"C:\Users\Admin\AppData\Local\Temp\Wave-Generator-App.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\Wave-Generator-App.exe
  "C:\Users\Admin\AppData\Local\Temp\Wave-Generator-App.exe"
  2⤵
  - Loads dropped DLL
  PID:2720

C:\Users\Admin\AppData\Local\Temp\_MEI24482\python311.dll

Filesize
1.6MB

MD5
c3de98791123bb12b315e2b4ce408d3b

SHA1
95c36944c9a4e8bb05a32e882835cac9c030c053

SHA256
98a51eca014369411df0980acbc16207d0de76c8adcd67fc27e1aa5e2f7731bb

SHA512
91651c0d5a1f55d296791aedb1594fe6b546dd16b7801af1ffa580486c99421f156ac86ccd5e22eacb7ad93fe8d3d909d50c9cc013e2618a29db8bf22183f9bc

Download Submit
memory/2720-53-0x000007FEF59F0000-0x000007FEF5FD9000-memory.dmp

Filesize
5.9MB

Download