1b6ecf8e755bb6dda1e1671555ffa659fb881205a59b1b916e0e934efc0ba6e4

Resubmissions

10-10-2024 00:55

10-10-2024 00:51

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 00:51

Target

Loader.exe
Size

7.5MB
MD5

544002c4428a25cd94b0c4350e0b591d
SHA1

8834d40cb58bdd2b511821ab59b78aecb5565686
SHA256

1b6ecf8e755bb6dda1e1671555ffa659fb881205a59b1b916e0e934efc0ba6e4
SHA512

20866a8aee4bc5f860f744df3f1fb8bf0c6ddd21cb539b08e26cef58895b0d0166e29bd284fb4b3ad0b1e52f52e560bcd29a1df761a3d7f4e8fcf88328001ae0
SSDEEP

196608:rFunqZVGwfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oSp:sYtIH2XgHq+jq93Yog

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2792	Loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000017570-21.dat	upx
behavioral1/memory/2792-23-0x000007FEF54E0000-0x000007FEF5BA2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2792	1152	Loader.exe	31
PID 1152 wrote to memory of 2792	1152	Loader.exe	31
PID 1152 wrote to memory of 2792	1152	Loader.exe	31

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2792

C:\Users\Admin\AppData\Local\Temp\_MEI11522\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/2792-23-0x000007FEF54E0000-0x000007FEF5BA2000-memory.dmp

Filesize
6.8MB

Download