bc9e6c3cecc4468d276110a0f4e6cb8c6f064e407e7154313548ae8476bd7e2c

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 15:58

Target

edge.exe
Size

68.7MB
MD5

7b7f169a4b4b5cfa663624a1c2287f12
SHA1

ed6c40c6f62997bedda4fce569c16a26a4adce25
SHA256

bc9e6c3cecc4468d276110a0f4e6cb8c6f064e407e7154313548ae8476bd7e2c
SHA512

610749a403d27841b6d5bf98b660914e6e4b0bc337ac0c8a452e5da413910498be09426406ae8c03c3623315e24a9cd831fd0d23b2a6bba892454322f6b8bca3
SSDEEP

98304:KBfrAEHhC5ai65sn6Wfz7pnxCb3AtZC0VZHtKpbzL8SG2XATHnm9Ik6nPxbsc3:K1rAErDOYbwtZVZibPpG2QrnsI5nlsk

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2848	edge.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4eb-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2848	2604	edge.exe	30
PID 2604 wrote to memory of 2848	2604	edge.exe	30
PID 2604 wrote to memory of 2848	2604	edge.exe	30

C:\Users\Admin\AppData\Local\Temp\edge.exe
"C:\Users\Admin\AppData\Local\Temp\edge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\edge.exe
  "C:\Users\Admin\AppData\Local\Temp\edge.exe"
  2⤵
  - Loads dropped DLL
  PID:2848

C:\Users\Admin\AppData\Local\Temp\_MEI26042\python310.dll

Filesize
1.4MB

MD5
76cb307e13fbbfb9e466458300da9052

SHA1
577f0029ac8c2dd64d6602917b7a26bcc2b27d2b

SHA256
95066c06d9ed165f0b6f34079ed917df1111bd681991f96952d9ee35d37dc615

SHA512
f15b17215057433d88f1a8e05c723a480b4f8bc56d42185c67bb29a192f435f54345aa0f6d827bd291e53c46a950f2e01151c28b084b7478044bd44009eced8f

Download Submit
memory/2848-23-0x000007FEF6680000-0x000007FEF6AEE000-memory.dmp

Filesize
4.4MB

Download