5f0fc08096058a29983544c5f09d9b724c0be4b4c93bed1a97a435bb120246a3

Analysis

max time kernel
15s
max time network
24s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-10-2024 20:29

Target

Built.exe
Size

17.6MB
MD5

d345395c94526a6560376c0fa4483825
SHA1

7124e8cec0641e614d599a55e0ced4527519f698
SHA256

5f0fc08096058a29983544c5f09d9b724c0be4b4c93bed1a97a435bb120246a3
SHA512

7a7c3fea87c88770a04f4a1fa84133932201366da19e7a60229cbeba2b155b4645792750b28a0c9e6aafcd3c2c92283d05287aebd4553e84b45e7b4713f2df2e
SSDEEP

393216:EFNhC2R4GD6zlIDovPUvNP+9V8MjC+WR+ijYpBX1NIH2gYBgDW4TOzn:EFNj5mzlgSPUF29lWRDyRBB+WTn

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2956	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0006000000016689-22.dat	upx
behavioral1/memory/2956-24-0x000007FEF62D0000-0x000007FEF6995000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2956	2400	Built.exe	28
PID 2400 wrote to memory of 2956	2400	Built.exe	28
PID 2400 wrote to memory of 2956	2400	Built.exe	28

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2956

C:\Users\Admin\AppData\Local\Temp\_MEI24002\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2956-24-0x000007FEF62D0000-0x000007FEF6995000-memory.dmp

Filesize
6.8MB

Download