5ac09a5c05205dc089af711c8de939512a20e0683f611730d3d410b235293f3f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 18:25

Target

FCFCCHEAT.exe
Size

7.4MB
MD5

1f0d3df315270ca370c5a33958b31b2b
SHA1

55f86eb687bc8b398ab9342fe3d9fe636dfd633b
SHA256

5ac09a5c05205dc089af711c8de939512a20e0683f611730d3d410b235293f3f
SHA512

47e2b0b07855d8f26e9db3a9c61fb6bc06fa8603d6fd72d1cabb1c512e0b538c7fe1014a780ffe2c28c4c95aa0746d6e1dbdd0fc661b80245d89c5c3cbf866f7
SSDEEP

98304:7NSi8TR+PurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EwKhOh112mJ3:78WurErvI9pWjgfPvzm6gsFEF4fv

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2884	FCFCCHEAT.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000600000001903d-21.dat	upx
behavioral1/memory/2884-23-0x000007FEF5BB0000-0x000007FEF61A2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2884	2872	FCFCCHEAT.exe	28
PID 2872 wrote to memory of 2884	2872	FCFCCHEAT.exe	28
PID 2872 wrote to memory of 2884	2872	FCFCCHEAT.exe	28

C:\Users\Admin\AppData\Local\Temp\FCFCCHEAT.exe
"C:\Users\Admin\AppData\Local\Temp\FCFCCHEAT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\FCFCCHEAT.exe
  "C:\Users\Admin\AppData\Local\Temp\FCFCCHEAT.exe"
  2⤵
  - Loads dropped DLL
  PID:2884

C:\Users\Admin\AppData\Local\Temp\_MEI28722\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2884-23-0x000007FEF5BB0000-0x000007FEF61A2000-memory.dmp

Filesize
5.9MB

Download