295ba090cceef8aa833fdcf782c0c374af661adb111c1ec31a0a45b7ff22036c

Analysis

max time kernel
99s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 00:17

Target

snosertaylerderden.exe
Size

7.4MB
MD5

427f6dec27a28325053863a0e146eb80
SHA1

ff44e440c2af5351c30be8e1d520664ecd0a248a
SHA256

295ba090cceef8aa833fdcf782c0c374af661adb111c1ec31a0a45b7ff22036c
SHA512

50ba2d0ac7e7a1728dc8f22ad52dc9a03668074d5c8f555f91b31379220455968488a02e35ec101556eab57ee6b2e030807c437b1de5e20c65ca5434340cb8f4
SSDEEP

98304:MGSi8x9XQsQurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EAKhOC1120:MBP9VQurErvI9pWjgfPvzm6gsFE14Av

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2872	snosertaylerderden.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a438-21.dat	upx
behavioral1/memory/2872-23-0x000007FEF5F00000-0x000007FEF64F2000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	snosertaylerderden.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2872	2448	snosertaylerderden.exe	30
PID 2448 wrote to memory of 2872	2448	snosertaylerderden.exe	30
PID 2448 wrote to memory of 2872	2448	snosertaylerderden.exe	30

C:\Users\Admin\AppData\Local\Temp\snosertaylerderden.exe
"C:\Users\Admin\AppData\Local\Temp\snosertaylerderden.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\snosertaylerderden.exe
  "C:\Users\Admin\AppData\Local\Temp\snosertaylerderden.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2872

C:\Users\Admin\AppData\Local\Temp\_MEI24482\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2872-23-0x000007FEF5F00000-0x000007FEF64F2000-memory.dmp

Filesize
5.9MB

Download
memory/2872-24-0x000007FEF5F00000-0x000007FEF64F2000-memory.dmp

Filesize
5.9MB

Download