63efbee5d3321fddd113d6ff67aae7dbad497a14c928fb40a0c87d8dbebb9f00

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 03:34

Target

baguettetools.exe
Size

7.5MB
MD5

6c93db007ac855a52224591dbb98b4e1
SHA1

b720c1f4253a4188f0fd221b645bc43463500116
SHA256

63efbee5d3321fddd113d6ff67aae7dbad497a14c928fb40a0c87d8dbebb9f00
SHA512

46a4cdc813b08ba0609622de44b075e5c3e9681308e883b357eaa23d8e8343ab906191b28df380c3ba8321cf45dac459867bd4ad9e9e6afba3d62057deac4415
SSDEEP

196608:AsgVVEfwfI9jUC2gYBYv3vbW2+iITx1U6nn:CVVE0IH2gYBgDWJTnzn

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2396	baguettetools.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195e0-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2396	1716	baguettetools.exe	28
PID 1716 wrote to memory of 2396	1716	baguettetools.exe	28
PID 1716 wrote to memory of 2396	1716	baguettetools.exe	28

C:\Users\Admin\AppData\Local\Temp\baguettetools.exe
"C:\Users\Admin\AppData\Local\Temp\baguettetools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\baguettetools.exe
  "C:\Users\Admin\AppData\Local\Temp\baguettetools.exe"
  2⤵
  - Loads dropped DLL
  PID:2396

C:\Users\Admin\AppData\Local\Temp\_MEI17162\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2396-24-0x000007FEF5910000-0x000007FEF5FD5000-memory.dmp

Filesize
6.8MB

Download