815d9c506e1ab5e11fde03c279d252ca77c5ab3d706e8e7d450a2692cc19f872

Analysis

max time kernel
25s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 08:01

Target

Built.exe
Size

7.5MB
MD5

84c515713b88e7e184b7cdf7d4becdbf
SHA1

a73462397d8fa8ad8192b244b0a33c54ee3146a9
SHA256

815d9c506e1ab5e11fde03c279d252ca77c5ab3d706e8e7d450a2692cc19f872
SHA512

8b0da1542bfeb49ab992e22048588b54d079f2e64f59ccff1ad99dcc10585065146231f3ccd7443a8e78954e0b23d5449e80b153773aeaa6f9e7b5932e7126d9
SSDEEP

196608:bsgVVE3ZwfI9jUC2gYBYv3vbW2+iITx1U6n6:ZVVE3mIH2gYBgDWJTnz6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2916	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2916-23-0x000007FEF55F0000-0x000007FEF5CB5000-memory.dmp	upx
behavioral1/files/0x000500000001944d-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2916	2852	Built.exe	31
PID 2852 wrote to memory of 2916	2852	Built.exe	31
PID 2852 wrote to memory of 2916	2852	Built.exe	31

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2916

\Users\Admin\AppData\Local\Temp\_MEI28522\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2916-23-0x000007FEF55F0000-0x000007FEF5CB5000-memory.dmp

Filesize
6.8MB

Download