e35bd1073ca8065d86590bbf20fce026e39f2206d7d9ccadd4b271f197c0bfbe

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:32

Target

Bloxy.exe
Size

76.6MB
MD5

09b56a741cc2cd996b6f6e511c22de17
SHA1

82bfe409baabfba667bf2959c0bca06183dff983
SHA256

e35bd1073ca8065d86590bbf20fce026e39f2206d7d9ccadd4b271f197c0bfbe
SHA512

0d20c11bb5dd88cad05a35fe4ed0c8916dfd64f2e710eab5c0588548902d32e8861864257ebf1160cbf1d5edec8e082e562084834af91eef48aa4faaf8ba9940
SSDEEP

1572864:WwvHcRlYSk8IpG7V+VPhqYdfME7FFlHFziYweyJulZUdgAdW4zjtux3a/Z9U:WwvHcRqSkB05awcfhdCpukdRPA49U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1816	Bloxy.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d300-1252.dat	upx
behavioral1/memory/1816-1254-0x000007FEF6070000-0x000007FEF6734000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1816	2968	Bloxy.exe	29
PID 2968 wrote to memory of 1816	2968	Bloxy.exe	29
PID 2968 wrote to memory of 1816	2968	Bloxy.exe	29

C:\Users\Admin\AppData\Local\Temp\Bloxy.exe
"C:\Users\Admin\AppData\Local\Temp\Bloxy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\Bloxy.exe
  "C:\Users\Admin\AppData\Local\Temp\Bloxy.exe"
  2⤵
  - Loads dropped DLL
  PID:1816

C:\Users\Admin\AppData\Local\Temp\_MEI29682\python312.dll

Filesize
1.7MB

MD5
506c760a20e6bb940590229d41449ffa

SHA1
b7c439f253987fb0ff66fc5ce959cf711b18eb8d

SHA256
e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5

SHA512
34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e

Download Submit
memory/1816-1254-0x000007FEF6070000-0x000007FEF6734000-memory.dmp

Filesize
6.8MB

Download