7a8ba863b86526b5aa7eb5efea18415162aef77a8cb1f2c328bf42edd3853b39

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 00:17

Target

reapware.exe
Size

7.4MB
MD5

3f88af2ff6c929380294ea6b406de9aa
SHA1

f95a0fa62b803094ce969b37364e3aa1d8079c52
SHA256

7a8ba863b86526b5aa7eb5efea18415162aef77a8cb1f2c328bf42edd3853b39
SHA512

68ce9bc911bc0f0d3fd6821bbd6b20afcfc71e0469d10e668c754900be16ed7b52af50813663d0b1c9a82f83848cc26e34afa82b3f6c3e2ac2c38e57657face9
SSDEEP

98304:vvSi8x9XQs0UurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EJKhOC11L:vaP9V0UurErvI9pWjgfPvzm6gsFEg4At

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2392	reapware.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019610-21.dat	upx
behavioral1/memory/2392-23-0x000007FEF59A0000-0x000007FEF5F92000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2392	1628	reapware.exe	30
PID 1628 wrote to memory of 2392	1628	reapware.exe	30
PID 1628 wrote to memory of 2392	1628	reapware.exe	30

C:\Users\Admin\AppData\Local\Temp\reapware.exe
"C:\Users\Admin\AppData\Local\Temp\reapware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\reapware.exe
  "C:\Users\Admin\AppData\Local\Temp\reapware.exe"
  2⤵
  - Loads dropped DLL
  PID:2392

C:\Users\Admin\AppData\Local\Temp\_MEI16282\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2392-23-0x000007FEF59A0000-0x000007FEF5F92000-memory.dmp

Filesize
5.9MB

Download