a5b9c17cf4dd9a6760ccfe66380956c0dce820667e04621ac818c94c42af7888

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 17:40

Target

PayPalMulti-tool.exe
Size

7.4MB
MD5

296ddcee049ee196f9e571f409ef43e8
SHA1

2d3da315df8275bf6a74f05f3f7d1f9b49393693
SHA256

a5b9c17cf4dd9a6760ccfe66380956c0dce820667e04621ac818c94c42af7888
SHA512

de018b5ca8178a51146b54916294eaed0d02a608864b2f894f778df6f5814dc5901f5da70e044cc7ad691192826230509a0ed677dab375c1065f8381c67c8e7c
SSDEEP

196608:sH0cDe+Ljv+bhqNVoBKUh8mz4Iv9Pfu1D7z:9ieCL+9qz8/b4INuRz

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1796	PayPalMulti-tool.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c3c-21.dat	upx
behavioral1/memory/1796-23-0x000007FEF6720000-0x000007FEF6D09000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1796	2380	PayPalMulti-tool.exe	29
PID 2380 wrote to memory of 1796	2380	PayPalMulti-tool.exe	29
PID 2380 wrote to memory of 1796	2380	PayPalMulti-tool.exe	29

C:\Users\Admin\AppData\Local\Temp\PayPalMulti-tool.exe
"C:\Users\Admin\AppData\Local\Temp\PayPalMulti-tool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\PayPalMulti-tool.exe
  "C:\Users\Admin\AppData\Local\Temp\PayPalMulti-tool.exe"
  2⤵
  - Loads dropped DLL
  PID:1796

C:\Users\Admin\AppData\Local\Temp\_MEI23802\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
memory/1796-23-0x000007FEF6720000-0x000007FEF6D09000-memory.dmp

Filesize
5.9MB

Download