92763eb4ab56f29f4f06e66c91bb7d58ed2f7f6c024612578d38cd50f1da800e

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:51

Target

xero.exe
Size

19.6MB
MD5

51a59b84b382c87fb5afb6f793c51af0
SHA1

3e1ce55d1c0f5dcff9f72a8d34a9d32a7710f009
SHA256

48033a75dbddda6de878f156a02550e5769225b36a4ebb8af70b60c1e2f0044b
SHA512

ac4cf466ac5476f13c28514c1afcb8a97162ddf2f6ae6ec4a77aa8253776759610f67086e27f3d31f2191a752944a813ac7c6f596e1fc251d65d91c7a3116782
SSDEEP

196608:uKJOErIxPR+0Jb3tQk5t3eNsHFJMIDJ+gsAGKkRpg70wKK:/JOE87v5tEYFqy+gs16p

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2568	xero.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4ed-51.dat	upx
behavioral1/memory/2568-53-0x000007FEF6860000-0x000007FEF6CCE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2568	2076	xero.exe	30
PID 2076 wrote to memory of 2568	2076	xero.exe	30
PID 2076 wrote to memory of 2568	2076	xero.exe	30

C:\Users\Admin\AppData\Local\Temp\xero.exe
"C:\Users\Admin\AppData\Local\Temp\xero.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\xero.exe
  "C:\Users\Admin\AppData\Local\Temp\xero.exe"
  2⤵
  - Loads dropped DLL
  PID:2568

C:\Users\Admin\AppData\Local\Temp\_MEI20762\python310.dll

Filesize
1.4MB

MD5
fc7bd515b12e537a39dc93a09b3eaad6

SHA1
96f5d4b0967372553cb106539c5566bc184f6167

SHA256
461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

SHA512
a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

Download Submit
memory/2568-53-0x000007FEF6860000-0x000007FEF6CCE000-memory.dmp

Filesize
4.4MB

Download