be32661052eb4dec9ffcd000552c142a30a7dfd714f4372ee0b72b42141bd4d5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-10-2024 20:51

Target

Universal Aim Lock(Beta).exe
Size

7.4MB
MD5

85b6d73aedf9a487c7ebc72f2deb219e
SHA1

28c34d30d1626bd282cf7cc0cb177b4db2fdc545
SHA256

be32661052eb4dec9ffcd000552c142a30a7dfd714f4372ee0b72b42141bd4d5
SHA512

aa09b30b983a9eecac86925366e67f37405f26f69f6ddd66fcbf2c648317e6243257cbbbd69088b08a23e4cc4b85db65929781dfbcc0bd3d5d5e8d2d5921239f
SSDEEP

98304:pVSi8x9XQso2UurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EAKhOC1p:pkP9VozurErvI9pWjgfPvzm6gsFE14Ap

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1644	Universal Aim Lock(Beta).exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001962b-21.dat	upx
behavioral1/memory/1644-23-0x000007FEF5EB0000-0x000007FEF64A2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1644	2348	Universal Aim Lock(Beta).exe	30
PID 2348 wrote to memory of 1644	2348	Universal Aim Lock(Beta).exe	30
PID 2348 wrote to memory of 1644	2348	Universal Aim Lock(Beta).exe	30

C:\Users\Admin\AppData\Local\Temp\Universal Aim Lock(Beta).exe
"C:\Users\Admin\AppData\Local\Temp\Universal Aim Lock(Beta).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\Universal Aim Lock(Beta).exe
  "C:\Users\Admin\AppData\Local\Temp\Universal Aim Lock(Beta).exe"
  2⤵
  - Loads dropped DLL
  PID:1644

C:\Users\Admin\AppData\Local\Temp\_MEI23482\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/1644-23-0x000007FEF5EB0000-0x000007FEF64A2000-memory.dmp

Filesize
5.9MB

Download