79ccfd8fed545beadcc308cc2d89892cb0b130a856ffd96e291ede9ca11ee988

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 23:56

Target

Scanner.exe
Size

7.5MB
MD5

1b1a4437dac2e98832ad514aa5940da8
SHA1

1be292c2268e8bf3d2b068d7ea654b96fa8180ff
SHA256

79ccfd8fed545beadcc308cc2d89892cb0b130a856ffd96e291ede9ca11ee988
SHA512

8a73c680ad0587489928c698b26df14ab58cf5be21e117468560d721f59a5bf4be61dc0132d6b371710f92aa9fa0d7eaa9b8938e2ec025ac8e15cfdaf4b4031b
SSDEEP

196608:6lunqZ0wfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oS6:nuIH2XgHq+jq93Yon

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2352	Scanner.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00060000000175f1-21.dat	upx
behavioral1/memory/2352-23-0x000007FEF5910000-0x000007FEF5FD2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2352	2336	Scanner.exe	31
PID 2336 wrote to memory of 2352	2336	Scanner.exe	31
PID 2336 wrote to memory of 2352	2336	Scanner.exe	31

C:\Users\Admin\AppData\Local\Temp\Scanner.exe
"C:\Users\Admin\AppData\Local\Temp\Scanner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\Scanner.exe
  "C:\Users\Admin\AppData\Local\Temp\Scanner.exe"
  2⤵
  - Loads dropped DLL
  PID:2352

C:\Users\Admin\AppData\Local\Temp\_MEI23362\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/2352-23-0x000007FEF5910000-0x000007FEF5FD2000-memory.dmp

Filesize
6.8MB

Download