b87be0acf41b31a187e0fde9788c167c488465f32bf8e62ebe19a816445580d9

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 11:18

Target

Loader.exe
Size

7.7MB
MD5

7c81d7e839d2dbc360c758e43a688282
SHA1

4d70a19d17a40041a4781979949b83a02f45c116
SHA256

b87be0acf41b31a187e0fde9788c167c488465f32bf8e62ebe19a816445580d9
SHA512

b70a705f5e7af34daded250b93feba65659fbd619c65fc1d9f5a2ef93795bc6556bb969cba65e409d9bb0b8f67138c55673c31ec711266630626f2da56b289a8
SSDEEP

196608:ThunqZYkwfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oSe:w5IH2XgHq+jq93Yo3

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2200	Loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000015d30-22.dat	upx
behavioral1/memory/2200-24-0x000007FEF63F0000-0x000007FEF6AB2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2200	1660	Loader.exe	30
PID 1660 wrote to memory of 2200	1660	Loader.exe	30
PID 1660 wrote to memory of 2200	1660	Loader.exe	30

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2200

C:\Users\Admin\AppData\Local\Temp\_MEI16602\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/2200-24-0x000007FEF63F0000-0x000007FEF6AB2000-memory.dmp

Filesize
6.8MB

Download