a157d6ce2c84c4d18e57ba2cd8e10de53729762944c29b087d3ece428bcc36fd

Analysis

max time kernel
17s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 02:00

Target

ElectronV3.exe
Size

37.8MB
MD5

9cc8a568e798cbe6662932da7233dcb3
SHA1

537c3aa9fd7730c39407f5df2dd1c1b6d9052f57
SHA256

a157d6ce2c84c4d18e57ba2cd8e10de53729762944c29b087d3ece428bcc36fd
SHA512

47a5598d45a55fad62be7a6f61d86d41d6431af7721d30fd2778f9ea46f0d52d2c67f21607defaf3fa5fcd258b1ff8ac25eb2a068fb57be2a2768163ef5416d2
SSDEEP

786432:S1mR73onp2D/L4Ex4uPvOkxSBG4kcxDD74R/7K4rv3FqbR:S16gu/EEC227ABch8R/GUqbR

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2280	ElectronV3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019645-47.dat	upx
behavioral1/memory/2280-49-0x000007FEF5E70000-0x000007FEF62D5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2280	2352	ElectronV3.exe	30
PID 2352 wrote to memory of 2280	2352	ElectronV3.exe	30
PID 2352 wrote to memory of 2280	2352	ElectronV3.exe	30

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2280

C:\Users\Admin\AppData\Local\Temp\_MEI23522\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2280-49-0x000007FEF5E70000-0x000007FEF62D5000-memory.dmp

Filesize
4.4MB

Download