0e34979b0e6ad3b2bd32d91768175a05f2a39782b1dd40b3f3a6deb920498b08

Resubmissions

20-10-2024 22:14

20-10-2024 22:10

max time kernel
98s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-10-2024 22:10

Target

cyder perm.exe
Size

7.5MB
MD5

da73cfdd266d2d0c39f0db9cd7c45578
SHA1

d8d3cc3a4e93b9099c855ae7e92d1dc2bf56d925
SHA256

0e34979b0e6ad3b2bd32d91768175a05f2a39782b1dd40b3f3a6deb920498b08
SHA512

714abd45725d7ee637362b29a186686caf5a5d05ec644a9d86fab1129865d5155b59c3d93a16587a44adaa046ce8026bb65cd7b0e6447524915e428ef3cd580f
SSDEEP

98304:uWSi8TRMXRUiurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EwKhOh11c:uxsBUiurErvI9pWjgfPvzm6gsFEF4f6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2356	cyder perm.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000015d30-22.dat	upx
behavioral1/memory/2356-24-0x000007FEF64C0000-0x000007FEF6AB2000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2356	cyder perm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2356	3060	cyder perm.exe	30
PID 3060 wrote to memory of 2356	3060	cyder perm.exe	30
PID 3060 wrote to memory of 2356	3060	cyder perm.exe	30

C:\Users\Admin\AppData\Local\Temp\cyder perm.exe
"C:\Users\Admin\AppData\Local\Temp\cyder perm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Local\Temp\cyder perm.exe
  "C:\Users\Admin\AppData\Local\Temp\cyder perm.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2356

C:\Users\Admin\AppData\Local\Temp\_MEI30602\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2356-24-0x000007FEF64C0000-0x000007FEF6AB2000-memory.dmp

Filesize
5.9MB

Download
memory/2356-25-0x000007FEF64C0000-0x000007FEF6AB2000-memory.dmp

Filesize
5.9MB

Download