8ae52f6852caea6485e55ec421a80696fe264447f122cde7017380892718eb88

Analysis

max time kernel
73s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 05:22

Target

loader.exe
Size

7.4MB
MD5

4d662bb483557cae6c840302696b8d4f
SHA1

7b0bb6f7b8e58a0840e32ea1faf0776013980cc6
SHA256

8ae52f6852caea6485e55ec421a80696fe264447f122cde7017380892718eb88
SHA512

ca4ed1ea327172d6fd9f3f1a51d233743f711de89fbf9246ddc8c1035449352855903f022a316841fd6f1272287f12e2cc49fa6008b07f6783c1ee31a596db29
SSDEEP

98304:zqSi8x9XQsTurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EAKhOC112K:zNP9VTurErvI9pWjgfPvzm6gsFE14AZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2528	loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001871c-21.dat	upx
behavioral1/memory/2528-23-0x000007FEF6000000-0x000007FEF65F2000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2528	2520	loader.exe	30
PID 2520 wrote to memory of 2528	2520	loader.exe	30
PID 2520 wrote to memory of 2528	2520	loader.exe	30

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:2528

C:\Users\Admin\AppData\Local\Temp\_MEI25202\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2528-23-0x000007FEF6000000-0x000007FEF65F2000-memory.dmp

Filesize
5.9MB

Download
memory/2528-24-0x000007FEF6000000-0x000007FEF65F2000-memory.dmp

Filesize
5.9MB

Download