2cba71e81382f66fdf71dca320a7fd413c4007a42a894df8c9b91f2f68d53853

Analysis

max time kernel
105s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 09:11

Target

grzegorzrat.exe
Size

6.6MB
MD5

fcfd2b39a40230801b219516842e1c27
SHA1

87e59e6df45a844efd2462acc24afcde3111e294
SHA256

2cba71e81382f66fdf71dca320a7fd413c4007a42a894df8c9b91f2f68d53853
SHA512

ff5e8b26493f61de2b79dc4c5b84886d513742574f85799fc8b74f6d79681ab8930a629c17471d2c2edcd3e5a485f0d8438f6489c61b2fd8ee154fb97e0c54de
SSDEEP

196608:F5FPweN/FJMIDJf0gsAGKXa1R9uAKpM4H:V/Fqyf0gsvEAKl

Score

7^/10

upx

Loads dropped DLL 2 IoCs

pid	Process
2776	grzegorzrat.exe
2776	grzegorzrat.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001951e-36.dat	upx
behavioral1/memory/2776-38-0x000007FEF6580000-0x000007FEF69EE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2776	1428	grzegorzrat.exe	30
PID 1428 wrote to memory of 2776	1428	grzegorzrat.exe	30
PID 1428 wrote to memory of 2776	1428	grzegorzrat.exe	30

C:\Users\Admin\AppData\Local\Temp\grzegorzrat.exe
"C:\Users\Admin\AppData\Local\Temp\grzegorzrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\grzegorzrat.exe
  "C:\Users\Admin\AppData\Local\Temp\grzegorzrat.exe"
  2⤵
  - Loads dropped DLL
  PID:2776

C:\Users\Admin\AppData\Local\Temp\_MEI14282\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14282\ucrtbase.dll

Filesize
1021KB

MD5
4e326feeb3ebf1e3eb21eeb224345727

SHA1
f156a272dbc6695cc170b6091ef8cd41db7ba040

SHA256
3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9

SHA512
be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

Download Submit
memory/2776-38-0x000007FEF6580000-0x000007FEF69EE000-memory.dmp

Filesize
4.4MB

Download