9475455e0ec2d114f77648dc3d4f8069ff058a6b75bd035b93fc74ff26de1b04

Analysis

max time kernel
2s
max time network
9s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
14-10-2024 13:10

Target

main.exe
Size

21.6MB
MD5

6e8eb744f99ad8f241fcec7be5f2462e
SHA1

4eeba364b0207fbe8669f532c63f22252618d943
SHA256

9475455e0ec2d114f77648dc3d4f8069ff058a6b75bd035b93fc74ff26de1b04
SHA512

39682eab9617712f7d546d9906e9c140f517b493b05aac25bff6f42a4bfca2d9517f571025ef1aceaab983120139d0e79faa573ee31f98bebf2ad0e7182ee0da
SSDEEP

393216:iLFXlr1pwde9TQDyRTDOEfYGLg9/MMHEJyIp0pjNff6Gqw9f0:cFXN1dQDyAWNMQuBaZ9

Score

7^/10

upx

Loads dropped DLL 2 IoCs

Processes:

main.exe

pid	Process
96	main.exe
96	main.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x000700000001ab05-102.dat	upx
behavioral1/memory/96-106-0x00007FF8EEF50000-0x00007FF8EF3BE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

main.exe

description	pid	Process	procid_target
PID 1756 wrote to memory of 96	1756	main.exe	70
PID 1756 wrote to memory of 96	1756	main.exe	70

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  PID:96

C:\Users\Admin\AppData\Local\Temp\_MEI17562\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17562\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17562\setuptools-65.5.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
memory/96-106-0x00007FF8EEF50000-0x00007FF8EF3BE000-memory.dmp

Filesize
4.4MB

Download