7bb40f2c8da1c11da3632804c53efe599e14c0740e84298b6bd2f16432266296

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 15:30

Target

TD Services/TD Temp.exe
Size

7.4MB
MD5

bf8add560c79745d7ee0b45515549c24
SHA1

18beeafcc1de02254599ee6337403687495fd6b8
SHA256

75040c2970554d4538984df2517e722cf6fcd6ce02cbd694a2ec59fb08fba623
SHA512

44a745eb9142e966831deabd83cbb93c7f80d78d90018153ba35fe09819f7f69af1aa1ebfaca664c802bd7bcf7cc2e3ea317000878cc71c6a56ca3d0728b0616
SSDEEP

98304:gDSi8x9XQsHurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EJKhOC1126:g2P9VHurErvI9pWjgfPvzm6gsFEg4At

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1564	TD Temp.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001960b-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1564	2600	TD Temp.exe	30
PID 2600 wrote to memory of 1564	2600	TD Temp.exe	30
PID 2600 wrote to memory of 1564	2600	TD Temp.exe	30

C:\Users\Admin\AppData\Local\Temp\TD Services\TD Temp.exe
"C:\Users\Admin\AppData\Local\Temp\TD Services\TD Temp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\TD Services\TD Temp.exe
  "C:\Users\Admin\AppData\Local\Temp\TD Services\TD Temp.exe"
  2⤵
  - Loads dropped DLL
  PID:1564

C:\Users\Admin\AppData\Local\Temp\_MEI26002\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/1564-23-0x000007FEF57D0000-0x000007FEF5DC2000-memory.dmp

Filesize
5.9MB

Download