850784d54367cf719db3a75e899588cd9a299ab42da80dfa2a19f670d234dc65

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 06:57

Target

hitboxy fivem 2024.exe
Size

10.0MB
MD5

dc6b9eaa417ac380895dfd554c0ff29d
SHA1

3976703a1e78d1445f72a528f4869e294eeea8e3
SHA256

850784d54367cf719db3a75e899588cd9a299ab42da80dfa2a19f670d234dc65
SHA512

737813ca5440888a7c222ef56de8f4f9dd99237d29c5f78d44c073752a555da8f5c6e2df9969d86e0f794303c1d1035ed1a834bcace0635651c0cd33e969afeb
SSDEEP

196608:LAumWeLNOjmFwDRxtYSHdK34kdai7bN3m2q4l6:7gYK2pM9B3Qrr

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2644	hitboxy fivem 2024.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018e96-21.dat	upx
behavioral1/memory/2644-23-0x000007FEF5E40000-0x000007FEF62A6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2644	3028	hitboxy fivem 2024.exe	30
PID 3028 wrote to memory of 2644	3028	hitboxy fivem 2024.exe	30
PID 3028 wrote to memory of 2644	3028	hitboxy fivem 2024.exe	30

C:\Users\Admin\AppData\Local\Temp\hitboxy fivem 2024.exe
"C:\Users\Admin\AppData\Local\Temp\hitboxy fivem 2024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\hitboxy fivem 2024.exe
  "C:\Users\Admin\AppData\Local\Temp\hitboxy fivem 2024.exe"
  2⤵
  - Loads dropped DLL
  PID:2644

C:\Users\Admin\AppData\Local\Temp\_MEI30282\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2644-23-0x000007FEF5E40000-0x000007FEF62A6000-memory.dmp

Filesize
4.4MB

Download