7a06809e8d9bf6fcdf17cd0aeb098c88adc4bcc4d3beebb735985a0b7a424809

Resubmissions

14-10-2024 21:59

13-10-2024 18:37

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 18:37

Target

Snail Temp/Snail Temp.exe
Size

80.3MB
MD5

8fd292ec59f027ee39c184f767e9c353
SHA1

7c7a9a08fecfcf95d532fb72014ebd031c8a6407
SHA256

bb91a8a6cbc909c53636590addcfe12d0184c536cdc64a74aa1e012af686fcda
SHA512

fe7ac31cfa67448f060bb2aa33d6b4667c72ec83ef58f0e2e6ada3c198874e4022a2da248e5d8e4771a77e0ab13ddd7865492e1419134f2def4b31af5160034b
SSDEEP

1572864:LvxZQglwWLcfZSk8IpG7V+VPhqclE7hliQiYgj+h58sMwr9TabkcJzU:LvxZxqdfZSkB05awcYwS5X9O/U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1316	Snail Temp.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020b4c-1260.dat	upx
behavioral1/memory/1316-1262-0x000007FEF5A80000-0x000007FEF6069000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1316	1988	Snail Temp.exe	30
PID 1988 wrote to memory of 1316	1988	Snail Temp.exe	30
PID 1988 wrote to memory of 1316	1988	Snail Temp.exe	30

C:\Users\Admin\AppData\Local\Temp\Snail Temp\Snail Temp.exe
"C:\Users\Admin\AppData\Local\Temp\Snail Temp\Snail Temp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\Snail Temp\Snail Temp.exe
  "C:\Users\Admin\AppData\Local\Temp\Snail Temp\Snail Temp.exe"
  2⤵
  - Loads dropped DLL
  PID:1316

C:\Users\Admin\AppData\Local\Temp\_MEI19882\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/1316-1262-0x000007FEF5A80000-0x000007FEF6069000-memory.dmp

Filesize
5.9MB

Download