aa9582350b7bdfda4c705f9dc7f8acc00ad767645b3a25bd92ff25fe4af2685e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 19:32

Target

Built.exe
Size

6.9MB
MD5

3cc660d3a85c25826a5f1af41511db25
SHA1

69183e43df0f931970d16e7d6637c5fb4eeee799
SHA256

aa9582350b7bdfda4c705f9dc7f8acc00ad767645b3a25bd92ff25fe4af2685e
SHA512

9ae88b78733cf91f46c1fb2fa787241f76b9351723deb3a2393d482d6a862e7b0d5a9f93116dbec2f81aa4e96b1b3160c29e253816e024fe9ca637ce85e5e3f2
SSDEEP

196608:mIV1vVhB6ylnlPzf+JiJCsmFMvln6hqg2:5VhBRlnlPSa7mmvlpg2

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2348	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000600000001746a-21.dat	upx
behavioral1/memory/2348-23-0x000007FEF5360000-0x000007FEF594A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2348	2872	Built.exe	30
PID 2872 wrote to memory of 2348	2872	Built.exe	30
PID 2872 wrote to memory of 2348	2872	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2348

C:\Users\Admin\AppData\Local\Temp\_MEI28722\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2348-23-0x000007FEF5360000-0x000007FEF594A000-memory.dmp

Filesize
5.9MB

Download