c448ebd8f3cdc7981bfab0cb15060fff0ffbd1e3c9029350dc6e4dab6789eef0

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 20:39

Target

Spoofer.exe
Size

76.8MB
MD5

259ebae45c96b2c72f2869236e64fa37
SHA1

3f15c7b2235684ac2fda90141737028b4297280c
SHA256

c448ebd8f3cdc7981bfab0cb15060fff0ffbd1e3c9029350dc6e4dab6789eef0
SHA512

2a5e182d78b097a1aabd258cc9bcd0e091da592313324dcf674d023befd9d95c85d77d88d56ca167e0b880dafd114c803192be705f293a3fb4bc0d181109b051
SSDEEP

1572864:d1lBWPY0ASk8IpG7V+VPhqYdIFE7vlhNiYweyJulZUdgErleqfaqZ9Uu:d1zbSkB05awcIeLapuwrd9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1676	Spoofer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a1b-1268.dat	upx
behavioral1/memory/1676-1270-0x000007FEF61D0000-0x000007FEF6895000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 1676	3040	Spoofer.exe	30
PID 3040 wrote to memory of 1676	3040	Spoofer.exe	30
PID 3040 wrote to memory of 1676	3040	Spoofer.exe	30

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
  2⤵
  - Loads dropped DLL
  PID:1676

C:\Users\Admin\AppData\Local\Temp\_MEI30402\python312.dll

Filesize
1.7MB

MD5
7ef625a8207c1a1a46cb084dfc747376

SHA1
8cc35164b7cda0ed43eb07fdb1ea62c23ae1b6f9

SHA256
c49c511fa244815cc1ab62a4dab0a4a0ffc0a1b99ac9333f60a3f795b99f65ed

SHA512
0872033ee3dc46066db3a44693d3802b5d158ef9e0481d1e33275934800cea6a79870ac0776a85f113daa67d9629b6d8bc67cea3d2a99445114140de1c29e5a4

Download Submit
memory/1676-1270-0x000007FEF61D0000-0x000007FEF6895000-memory.dmp

Filesize
6.8MB

Download