f02f0082a3c2689e50f5dccd8281c0765eab30be9587d776074fdcab53dd330a

Analysis

max time kernel
7s
max time network
1s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 15:33

Target

Versal Menu.exe
Size

17.9MB
MD5

98a6eedb80ba3cea58463c194198170f
SHA1

41cd61bce83f665c4384d4f34a1fe8ca7d5afa73
SHA256

f02f0082a3c2689e50f5dccd8281c0765eab30be9587d776074fdcab53dd330a
SHA512

5390fda347447681649f4634a062e1ea0d02d7ba33de56bc7b64aaf1ed115cd3959272630b167e7b52e56108e057bc4f111f351f885a1b411a2656423568359f
SSDEEP

393216:W8UmpKcq0Fzuf+YliGU+4LESXsurEUWjC3zDbY4ft:WIpKt0FKf+4UJVcdbCc4ft

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2692	Versal Menu.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019494-22.dat	upx
behavioral1/memory/2692-24-0x000007FEF54C0000-0x000007FEF5AB2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2692	2400	Versal Menu.exe	30
PID 2400 wrote to memory of 2692	2400	Versal Menu.exe	30
PID 2400 wrote to memory of 2692	2400	Versal Menu.exe	30

C:\Users\Admin\AppData\Local\Temp\Versal Menu.exe
"C:\Users\Admin\AppData\Local\Temp\Versal Menu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\Versal Menu.exe
  "C:\Users\Admin\AppData\Local\Temp\Versal Menu.exe"
  2⤵
  - Loads dropped DLL
  PID:2692

C:\Users\Admin\AppData\Local\Temp\_MEI24002\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2692-24-0x000007FEF54C0000-0x000007FEF5AB2000-memory.dmp

Filesize
5.9MB

Download