40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 03:43

Target

40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe
Size

6.9MB
MD5

8fd2e361c15bccc12ffdefc6cf5476c0
SHA1

ee3513be0e7b4f8d61c48fc8ac1162debe7f8e78
SHA256

40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1
SHA512

a2852de54c51bbdf52b203ecce37702775156569caf1659139dc6d09839598cf9f55c9f35a069144039b0ef9b520987201e400751ab665cea352f9efdf731117
SSDEEP

98304:olDjWM8JEE1rdJEOPamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhZ:ol0NyZeNTfm/pf+xk4dWRptrbWOjgrA

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1972	40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000193d5-21.dat	upx
behavioral1/memory/1972-23-0x000007FEF59A0000-0x000007FEF5F88000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1972	2568	40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe	31
PID 2568 wrote to memory of 1972	2568	40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe	31
PID 2568 wrote to memory of 1972	2568	40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe	31

C:\Users\Admin\AppData\Local\Temp\40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe
"C:\Users\Admin\AppData\Local\Temp\40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe
  "C:\Users\Admin\AppData\Local\Temp\40bfbdea459e8836ddba3caf5a231db5e50693dc2600cc7b878ba8af01484cd1N.exe"
  2⤵
  - Loads dropped DLL
  PID:1972

C:\Users\Admin\AppData\Local\Temp\_MEI25682\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
memory/1972-23-0x000007FEF59A0000-0x000007FEF5F88000-memory.dmp

Filesize
5.9MB

Download