801b6a76fb426d2ec7658f849fb6279489d827f03997d052eb969a709a8c6793

Resubmissions

28-10-2024 19:00

241028-xnwrrsvfpn 10

28-10-2024 18:32

241028-w6smdsvcra 10

28-10-2024 18:30

241028-w5wbwsspdt 10

28-10-2024 17:56

241028-wh5l2svbpf 10

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PrimordialCrack.exe
Size

7.5MB
MD5

0738a5a832b62e68a740aa3401d332ef
SHA1

3f3b0acdc4cc580de58495ca3b5a2aa305362825
SHA256

801b6a76fb426d2ec7658f849fb6279489d827f03997d052eb969a709a8c6793
SHA512

0f008f61aa87d1efb5c83f1bf701112565aee0b2991645e36e0e10d0aa415e9b8ed9972bf847cba90bfd2549d1233599b6c9adc174e354e181d267cbe51429ce
SSDEEP

196608:wct1WurErvI9pWjgaAnajMsK2CfQCS/OinHC1e:dt1WurEUWjJjYRoPhHYe

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2768	PrimordialCrack.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019d2d-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2768	2216	PrimordialCrack.exe	30
PID 2216 wrote to memory of 2768	2216	PrimordialCrack.exe	30
PID 2216 wrote to memory of 2768	2216	PrimordialCrack.exe	30

C:\Users\Admin\AppData\Local\Temp\PrimordialCrack.exe
"C:\Users\Admin\AppData\Local\Temp\PrimordialCrack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\PrimordialCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\PrimordialCrack.exe"
  2⤵
  - Loads dropped DLL
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22162\python312.dll

Filesize
1.7MB

MD5
fb8bedf8440eb432c9f3587b8114abc0

SHA1
136bb4dd38a7f6cb3e2613910607131c97674f7c

SHA256
cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6

SHA512
b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

Download Submit
memory/2768-23-0x000007FEF6230000-0x000007FEF68F5000-memory.dmp

Filesize
6.8MB

Download