eec647abba9d0594e0f3ba261c7473f633f8f4af119d59faf387e847d3bd789b

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 02:46

Target

ZORARAKeyGen.exe
Size

7.5MB
MD5

e38932123a595819ab3e191b0ee5c121
SHA1

a7fc575b31ad13a52be5dbd59857116472da38da
SHA256

eec647abba9d0594e0f3ba261c7473f633f8f4af119d59faf387e847d3bd789b
SHA512

3ced6fb1dc3f5b3a15384c1e3accb40aca440665b7f1411beee8f0df7f5ec837ba63b9892429b41e8b996e18f3c4bda88b959a55bbfcb8e4be35de64f3136b42
SSDEEP

196608:8XWEzvLjv+bhqNVoB8Ck5c7GpNlpq41J2vbk9qtl8f8jS/:EWgL+9qz88Ck+7q3p91J3dfES/

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1852	ZORARAKeyGen.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019268-21.dat	upx
behavioral1/memory/1852-23-0x000007FEF5EE0000-0x000007FEF65B8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1852	1716	ZORARAKeyGen.exe	30
PID 1716 wrote to memory of 1852	1716	ZORARAKeyGen.exe	30
PID 1716 wrote to memory of 1852	1716	ZORARAKeyGen.exe	30

C:\Users\Admin\AppData\Local\Temp\ZORARAKeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\ZORARAKeyGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\ZORARAKeyGen.exe
  "C:\Users\Admin\AppData\Local\Temp\ZORARAKeyGen.exe"
  2⤵
  - Loads dropped DLL
  PID:1852

C:\Users\Admin\AppData\Local\Temp\_MEI17162\python312.dll

Filesize
1.8MB

MD5
2f1072ddd9a88629205e7434ed055b3e

SHA1
20da3188dabe3d5fa33b46bfe671e713e6fa3056

SHA256
d086257a6b36047f35202266c8eb8c1225163bd96b064d31b80f0dbe13da2acf

SHA512
d8dddc30733811ed9a9c4ae83ac8f3fc4d8ba3fa8051d95242fbd432fd5bf24122373ac5eea9fec78f0daf7c1133365f519a13cf3f105636da74820a00a25e9b

Download Submit
memory/1852-23-0x000007FEF5EE0000-0x000007FEF65B8000-memory.dmp

Filesize
6.8MB

Download