cb918104368d23c5df12005d5b117b97ea3aa8720c466d7b85a8bbc2e964f543

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 23:09

Target

titain cord.exe
Size

78.0MB
MD5

f540be89c9a860efb26e48a1bcd8475c
SHA1

2490961292e21a22c8f00f7f62802b27a9840387
SHA256

6fb84ed1caf2f687f0cf2c3d1440d1e99f94ce06aebe3e448faf1329489b7259
SHA512

712c0ebd222dd136533f43e2de7ce87b2b2d695a2bffdbe2f2430529f9d22cd232788c6bd9a861976b2549f1a626ea94c8e5ad0fb623a7347dd743022c187abb
SSDEEP

196608:hagVVEqwfI9jUC2gYBYv3vbW2+iITx1U6nW:pVVE5IH2gYBgDWJTnzW

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2424	titain cord.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016dea-21.dat	upx
behavioral1/memory/2424-23-0x000007FEF5BA0000-0x000007FEF6265000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2424	titain cord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	titain cord.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2424	2068	titain cord.exe	30
PID 2068 wrote to memory of 2424	2068	titain cord.exe	30
PID 2068 wrote to memory of 2424	2068	titain cord.exe	30

C:\Users\Admin\AppData\Local\Temp\titain cord.exe
"C:\Users\Admin\AppData\Local\Temp\titain cord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\titain cord.exe
  "C:\Users\Admin\AppData\Local\Temp\titain cord.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2424

C:\Users\Admin\AppData\Local\Temp\_MEI20682\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2424-23-0x000007FEF5BA0000-0x000007FEF6265000-memory.dmp

Filesize
6.8MB

Download
memory/2424-24-0x000007FEF5BA0000-0x000007FEF6265000-memory.dmp

Filesize
6.8MB

Download