6af1a5fb3588c490e351b4a54371970dbd3324d916476eb26c6c1ff7cc7bea2f

Analysis

max time kernel
1566s
max time network
1568s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 14:46

Target

source_prepared.exe
Size

76.9MB
MD5

d9ef68f788f32aa2b44445cc258a1aed
SHA1

8f96ce920b6715836e3826f5be4548a195db3b72
SHA256

6af1a5fb3588c490e351b4a54371970dbd3324d916476eb26c6c1ff7cc7bea2f
SHA512

8ca2fc651bcc8e8d1bfc601b754664d4bcda6e63e21a4fdf5cea3ef3c242767cb269cd86bb1a2e483078b8139cb48c88f707b238357cb8e96179bee29fbbbfd4
SSDEEP

1572864:r1lfWhS0ASk8IpG7V+VPhqYdfzE7gFlhq4iYweyJulZUdgM34X5ypJ/Z9UG:r1F1SkB05awcftLypuQ3DZ9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2660	source_prepared.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020ae9-1267.dat	upx
behavioral1/memory/2660-1269-0x000007FEF6300000-0x000007FEF69C4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2660	2080	source_prepared.exe	31
PID 2080 wrote to memory of 2660	2080	source_prepared.exe	31
PID 2080 wrote to memory of 2660	2080	source_prepared.exe	31

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2660

C:\Users\Admin\AppData\Local\Temp\_MEI20802\python312.dll

Filesize
1.7MB

MD5
506c760a20e6bb940590229d41449ffa

SHA1
b7c439f253987fb0ff66fc5ce959cf711b18eb8d

SHA256
e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5

SHA512
34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e

Download Submit
memory/2660-1269-0x000007FEF6300000-0x000007FEF69C4000-memory.dmp

Filesize
6.8MB

Download
memory/2660-2536-0x000007FEF6300000-0x000007FEF69C4000-memory.dmp

Filesize
6.8MB

Download