94b1aee4ca3f71653b2a7dd14c67384416acb7b7b3bbcdc6b62abbf47fc1394f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 22:52

Target

BLTools v2.9 PRO/CookiesCreator.exe
Size

7.4MB
MD5

8a7d8331bc19b52df1526c417d6383ba
SHA1

6fefd8f132afe1dc3f2561e95d6a01f9ade0f758
SHA256

9ed9cd27c0fa9db840589e42d402e2fe7da3d65fb6d12770dc773dfda7a40139
SHA512

afb2eef04d33bab1dbdbd8ead3ee2a8f5a681a1bb534c28ee9675aa0d77298491101620a9b50f8fecf48c306542c55320fd51922becdf67abc40106281cd984e
SSDEEP

196608:EutPurErvI9pWjgaAnajMsK23fQC//OoLxhf:3tPurEUWjJjYoo4jLxhf

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2904	CookiesCreator.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/files/0x000500000001a4a0-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2904	2252	CookiesCreator.exe	30
PID 2252 wrote to memory of 2904	2252	CookiesCreator.exe	30
PID 2252 wrote to memory of 2904	2252	CookiesCreator.exe	30

C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe
"C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe
  "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 PRO\CookiesCreator.exe"
  2⤵
  - Loads dropped DLL
  PID:2904

C:\Users\Admin\AppData\Local\Temp\_MEI22522\python312.dll

Filesize
1.7MB

MD5
fb8bedf8440eb432c9f3587b8114abc0

SHA1
136bb4dd38a7f6cb3e2613910607131c97674f7c

SHA256
cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6

SHA512
b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

Download Submit
memory/2252-47-0x000000013F070000-0x000000013F0A2000-memory.dmp

Filesize
200KB

Download
memory/2904-24-0x000007FEF5670000-0x000007FEF5D35000-memory.dmp

Filesize
6.8MB

Download
memory/2904-25-0x000000013F070000-0x000000013F0A2000-memory.dmp

Filesize
200KB

Download