3b91d7f0be55606bcdf71b37a18f34c298156b12181ff7c944fb7a1818916736

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/10/2024, 04:52

Target

Built.exe
Size

7.5MB
MD5

f6c1ca73d58bee19392afdf533bac4b3
SHA1

35e4a258a6f3834e7a3164d929b6333ba91ab9d9
SHA256

ea7ff4296f265854109ce36e1cd4e1d4b9afd94fe5d22392421da5b07c9f5e32
SHA512

714fdc94576245696b9c7948cc997a536380e54b5a2b2342321e3ef50ae8d413ab91c71774510defe28245b7e7d6d410905a76922cc3da4305c772a3043a8435
SSDEEP

196608:EjgVVEugwfI9jUC2gYBYv3vbW2+iITx1U6nu:XVVEu/IH2gYBgDWJTnzu

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2496	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral3/files/0x0006000000016ca0-21.dat	upx
behavioral3/memory/2496-23-0x000007FEF57A0000-0x000007FEF5E65000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2496	1736	Built.exe	30
PID 1736 wrote to memory of 2496	1736	Built.exe	30
PID 1736 wrote to memory of 2496	1736	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2496

C:\Users\Admin\AppData\Local\Temp\_MEI17362\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2496-23-0x000007FEF57A0000-0x000007FEF5E65000-memory.dmp

Filesize
6.8MB

Download