824b514ab771e1faf23f3c33c3450d607e0750bbf8f1cc1143cbb775e991bec3

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 02:22

Target

Loader.exe
Size

7.5MB
MD5

8f2b009d265cf435f3eacff4f217e2e4
SHA1

c5f228932332f5823c92977b22308b4429ed95ac
SHA256

824b514ab771e1faf23f3c33c3450d607e0750bbf8f1cc1143cbb775e991bec3
SHA512

074e8dc888e3d514a63c6cb15816c8c34953c24ea33d589a73e48499fbd18904f3b43a8ed33b6d52d6935e202414c5cc041fd817244ae5e9e5c0e1d37a9703e4
SSDEEP

196608:GMgVVEawfI9jUC2gYBYv3vbW2+iITx1U6nq:8VVEJIH2gYBgDWJTnzq

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2664	Loader.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018f2c-21.dat	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	Loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2664	3064	Loader.exe	30
PID 3064 wrote to memory of 2664	3064	Loader.exe	30
PID 3064 wrote to memory of 2664	3064	Loader.exe	30

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2664

C:\Users\Admin\AppData\Local\Temp\_MEI30642\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2664-23-0x000007FEF62F0000-0x000007FEF69B5000-memory.dmp

Filesize
6.8MB

Download
memory/2664-24-0x000007FEF62F0000-0x000007FEF69B5000-memory.dmp

Filesize
6.8MB

Download