6d52a3cf9938cde7bb5d1a9027696a8478b0326e362b2d786f488373e2a49660

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 16:28

Target

xcleaner.exe
Size

20.3MB
MD5

6f4d51394003bea72521f8e8577679cc
SHA1

6a2e745199d932967009c6c324bd65af819ee826
SHA256

6d52a3cf9938cde7bb5d1a9027696a8478b0326e362b2d786f488373e2a49660
SHA512

dc3b2dfaf7ceddcf2241d51d7cf6f3b1db8131c8b24b0524a5bb122597468e4e31f0910ae91f889aa794202c46484e11b0082612f86cabfbb10511290f22cc9c
SSDEEP

393216:E6Z6Wh2Jp5M7RHdgxro/w3uCxHQblJgB:E6Z6WhhCrv3Fqb7

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2604	xcleaner.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019da9-46.dat	upx
behavioral1/memory/2604-48-0x000007FEF6D00000-0x000007FEF7165000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2604	2804	xcleaner.exe	30
PID 2804 wrote to memory of 2604	2804	xcleaner.exe	30
PID 2804 wrote to memory of 2604	2804	xcleaner.exe	30

C:\Users\Admin\AppData\Local\Temp\xcleaner.exe
"C:\Users\Admin\AppData\Local\Temp\xcleaner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\xcleaner.exe
  "C:\Users\Admin\AppData\Local\Temp\xcleaner.exe"
  2⤵
  - Loads dropped DLL
  PID:2604

C:\Users\Admin\AppData\Local\Temp\_MEI28042\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2604-48-0x000007FEF6D00000-0x000007FEF7165000-memory.dmp

Filesize
4.4MB

Download