299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005

Analysis

max time kernel
18s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 03:12

Target

299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe
Size

6.8MB
MD5

9fa9e8da0413487aebbc8f95dd0fe450
SHA1

07abbdd14762a5548e30fb25182ee102b52c84d0
SHA256

299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005
SHA512

300389a022760753439476f1caa3c5cbeba2c087fc30a9fd3456627e1d761e3ce19b9fa17f9e4798b83a54f74ce45292a30a0e1f16b7052543072833e91a0ba5
SSDEEP

196608:JOV1ZZB6ylnlPzf+JiJCsmFMvNn6hVvTs:IZBRlnlPSa7mmvN+rs

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2032	299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195cc-21.dat	upx
behavioral1/memory/2032-23-0x000007FEF5A90000-0x000007FEF607A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2032	2120	299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe	30
PID 2120 wrote to memory of 2032	2120	299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe	30
PID 2120 wrote to memory of 2032	2120	299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe	30

C:\Users\Admin\AppData\Local\Temp\299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe
"C:\Users\Admin\AppData\Local\Temp\299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe
  "C:\Users\Admin\AppData\Local\Temp\299deba70c83f2069cb7cac52da7953bff6c6d15043aba4c10c98801f3388005N.exe"
  2⤵
  - Loads dropped DLL
  PID:2032

C:\Users\Admin\AppData\Local\Temp\_MEI21202\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2032-23-0x000007FEF5A90000-0x000007FEF607A000-memory.dmp

Filesize
5.9MB

Download