3d1756359acdee570f300f04cbec9d974fa20542d16c0470e9c55c2ef2553e5f

Resubmissions

17-10-2024 18:53

17-10-2024 18:45

max time kernel
93s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 18:45

Target

Built.exe
Size

6.8MB
MD5

1baa9df749f4ad31eb3bbc4d54a05499
SHA1

5d37358dfe82c1c307338e39e022557a53fdb7fd
SHA256

3d1756359acdee570f300f04cbec9d974fa20542d16c0470e9c55c2ef2553e5f
SHA512

e7ecd2ac6f4704e5e57b6165248d7a162b99eeb831230ad3f878ab7c72ff725ed19225a2be3f89cbc11f7fe9d2cad105ab4a5fe8a840da60f99be6c433443980
SSDEEP

196608:1YV1F/B6ylnlPzf+JiJCsmFMvNn6hVvTc:cBRlnlPSa7mmvN+rc

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2504	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000196a1-21.dat	upx
behavioral1/memory/2504-23-0x000007FEF6370000-0x000007FEF695A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2504	1760	Built.exe	30
PID 1760 wrote to memory of 2504	1760	Built.exe	30
PID 1760 wrote to memory of 2504	1760	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2504

C:\Users\Admin\AppData\Local\Temp\_MEI17602\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2504-23-0x000007FEF6370000-0x000007FEF695A000-memory.dmp

Filesize
5.9MB

Download