3179e176a06c90654c5b09926827b60c79f9c8d951bb64c982ad531571287434

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 18:43

Target

BlakTool.exe
Size

24.8MB
MD5

a053448552bfad71ae030068b669ce67
SHA1

260da910d644ca868ea9be489e243c0f7edd6544
SHA256

3179e176a06c90654c5b09926827b60c79f9c8d951bb64c982ad531571287434
SHA512

8877b1f5fa0049e776b0b25f4123523ba29667ed54ab6dc56f0580817a3e71e5761677524ed89589c1ee2a90b3596c79ee9c9dc31b4e559c7d7a490f6875f00b
SSDEEP

393216:nlkVni+kqfp1uhf48a1kq9tse4Yw+LTR2wfhtm1FurEUWjC3zDbd4AC:nlkVqmp1Whaa4Gd+Ll2wpI3dbCh4AC

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2796	BlakTool.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000194e6-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2796	2828	BlakTool.exe	30
PID 2828 wrote to memory of 2796	2828	BlakTool.exe	30
PID 2828 wrote to memory of 2796	2828	BlakTool.exe	30

C:\Users\Admin\AppData\Local\Temp\BlakTool.exe
"C:\Users\Admin\AppData\Local\Temp\BlakTool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\BlakTool.exe
  "C:\Users\Admin\AppData\Local\Temp\BlakTool.exe"
  2⤵
  - Loads dropped DLL
  PID:2796

C:\Users\Admin\AppData\Local\Temp\_MEI28282\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2796-24-0x000007FEF6220000-0x000007FEF6812000-memory.dmp

Filesize
5.9MB

Download