45fcc62703ed1f2694a1507c7ab5f9511b2384fd4b2d1b62c38dd2b5f15c2f5f

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:33

Target

Hellion5.exe
Size

9.4MB
MD5

590541980dce6d68a1a8d6ad9143d90c
SHA1

231ff4afaf6d3ed80e801f96c51d73e1708ea6c4
SHA256

a6fefc7e8870875849c51fec5cd0e7f6c5c7a698dfd9950d52c40e04d4e422c5
SHA512

52745f7ff9c6545561292e0d9fbffa4713ec3889cb4e8d2126ebecba59c3c9fe286f3741035da1e7da830bbcc00dc9c702cd13f67c2654b65c5ede6f242751e1
SSDEEP

196608:ql0xzKISwLRXgWPmpzdhqiYB6yD+KdWrOI11:g0xzh5L1V8d8BR5V

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2884	Hellion5.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a471-46.dat	upx
behavioral1/memory/2884-48-0x000007FEF6350000-0x000007FEF67B6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2884	2580	Hellion5.exe	31
PID 2580 wrote to memory of 2884	2580	Hellion5.exe	31
PID 2580 wrote to memory of 2884	2580	Hellion5.exe	31

C:\Users\Admin\AppData\Local\Temp\Hellion5.exe
"C:\Users\Admin\AppData\Local\Temp\Hellion5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\Hellion5.exe
  "C:\Users\Admin\AppData\Local\Temp\Hellion5.exe"
  2⤵
  - Loads dropped DLL
  PID:2884

C:\Users\Admin\AppData\Local\Temp\_MEI25802\python310.dll

Filesize
1.4MB

MD5
259f0b7b6eed52d7766fa294ee0db193

SHA1
f158995508e460c47748666219a54ee575973397

SHA256
9b88ca9240770931a2041e6d05ad4508b391859f8ed3603303935dcc1e55c406

SHA512
7efd3402d4cbd1146444fdab5eeb4a8aab6fec04b718761da3e0fd417d67e9576fc354737b3453f9e9c12210f1930e6eadd7c0570242b0c8a548fdb92051360c

Download Submit
memory/2884-48-0x000007FEF6350000-0x000007FEF67B6000-memory.dmp

Filesize
4.4MB

Download