c575cedf35b7070b62b0b0e9b14d1da3ccef1d0dba313376de2dc15328949824

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 20:28

Target

CSINT.exe
Size

7.5MB
MD5

c58c6483da959aad5d99865db9707ac6
SHA1

dcf04350e41cf580f6c75e3262d2739574a619ea
SHA256

c575cedf35b7070b62b0b0e9b14d1da3ccef1d0dba313376de2dc15328949824
SHA512

1c68c2122a05aff5b8dd0b82de21705b19ecbf82b1023d8eb48503af82a001e5f965cfa9326dbbf11b8a20cac885450822a0a641239bd9c0e5da509dd2799295
SSDEEP

196608:uvgVVEbwfI9jUC2gYBYv3vbW2+iITx1U6nm:5VVEYIH2gYBgDWJTnzm

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2772	CSINT.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195c4-21.dat	upx
behavioral1/memory/2772-23-0x000007FEF6900000-0x000007FEF6FC5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2772	2756	CSINT.exe	31
PID 2756 wrote to memory of 2772	2756	CSINT.exe	31
PID 2756 wrote to memory of 2772	2756	CSINT.exe	31

C:\Users\Admin\AppData\Local\Temp\CSINT.exe
"C:\Users\Admin\AppData\Local\Temp\CSINT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\CSINT.exe
  "C:\Users\Admin\AppData\Local\Temp\CSINT.exe"
  2⤵
  - Loads dropped DLL
  PID:2772

C:\Users\Admin\AppData\Local\Temp\_MEI27562\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2772-23-0x000007FEF6900000-0x000007FEF6FC5000-memory.dmp

Filesize
6.8MB

Download