1c00e69d52df9eff9f68fdf941e9c2d065588007635682a3a0b532c4f0620554

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 22:27

Target

Image Logger.exe
Size

7.5MB
MD5

8035fb095835453326a0c57217d5006a
SHA1

8881f8dcbe63b0620022213a65a189f35479d477
SHA256

1c00e69d52df9eff9f68fdf941e9c2d065588007635682a3a0b532c4f0620554
SHA512

eba4b97192a41c6fad8f36b7d7a9cfbfa6ff8e70ce3c57946d39500fb47b6d17b87fc1c0e09d6dde6e690c80d5b4d5f3db4091f4aa3509c352db7d4352ba6dc9
SSDEEP

196608:7TgVVEcwfI9jUC2gYBYv3vbW2+iITx1U6nu:oVVEDIH2gYBgDWJTnzu

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
544	Image Logger.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000194d8-21.dat	upx
behavioral1/memory/544-23-0x000007FEF61C0000-0x000007FEF6885000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 544	3012	Image Logger.exe	30
PID 3012 wrote to memory of 544	3012	Image Logger.exe	30
PID 3012 wrote to memory of 544	3012	Image Logger.exe	30

C:\Users\Admin\AppData\Local\Temp\Image Logger.exe
"C:\Users\Admin\AppData\Local\Temp\Image Logger.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\Image Logger.exe
  "C:\Users\Admin\AppData\Local\Temp\Image Logger.exe"
  2⤵
  - Loads dropped DLL
  PID:544

C:\Users\Admin\AppData\Local\Temp\_MEI30122\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/544-23-0x000007FEF61C0000-0x000007FEF6885000-memory.dmp

Filesize
6.8MB

Download