18046714a0b2a4e4d18dd69b7948313ceb6bb2f9a02f1053ec481e11b7626990

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 22:11

Target

Built.exe
Size

6.9MB
MD5

c10450f99c715563a90b3966823ef973
SHA1

9ac1c7c5b44753617c41d14a4c943e816641e4c5
SHA256

18046714a0b2a4e4d18dd69b7948313ceb6bb2f9a02f1053ec481e11b7626990
SHA512

76bf8dfb8a8f41ed2b4fa46ba4d86348ef758f002c59f9ec5b9f13fada95dd1fdee9495fe94f5678ddc0d1b1f45d677299f91c737442d947c6e813cf9fd0b3b3
SSDEEP

98304:DnDjWM8JEE1rgamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIFWJ:Dn0xeNTfm/pf+xk4dWRptrbWOjgrf

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2964	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019643-21.dat	upx
behavioral1/memory/2964-23-0x000007FEF6820000-0x000007FEF6E08000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2964	576	Built.exe	30
PID 576 wrote to memory of 2964	576	Built.exe	30
PID 576 wrote to memory of 2964	576	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2964

C:\Users\Admin\AppData\Local\Temp\_MEI5762\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
memory/2964-23-0x000007FEF6820000-0x000007FEF6E08000-memory.dmp

Filesize
5.9MB

Download