cbf2298dc3efc09004194927be89c5dada6cf5c471c0033c8d96ed559831071f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:51

Target

WaveGeneratorApp.exe
Size

11.4MB
MD5

6adfabca30811868e167bcb02da7276a
SHA1

b22b42a7987fe79b1b068801f85fa07a522e0d0c
SHA256

4c1b3c835bd60d28f703c1fc21c4b49ab8c530c4c13ddd125b97c3a23fc0bd4d
SHA512

50677d0ea7750ba40c9cf1e4680260c2871d8ff397c3264c2c902a313e7829f02292d666fa2186f5c16f19bccc996d495da41d009a32d9d7a7f1888742e8de5a
SSDEEP

196608:L03MDhGreGJb3tQk5tSOshoKMuIkhVAastRL5DicJUGc1K7kC8Gx:4YhGL7v5tSOshouIkPAftRL5dYY8Gx

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2848	WaveGeneratorApp.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c59-51.dat	upx
behavioral1/memory/2848-53-0x000007FEF6110000-0x000007FEF66F9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2848	1904	WaveGeneratorApp.exe	30
PID 1904 wrote to memory of 2848	1904	WaveGeneratorApp.exe	30
PID 1904 wrote to memory of 2848	1904	WaveGeneratorApp.exe	30

C:\Users\Admin\AppData\Local\Temp\WaveGeneratorApp.exe
"C:\Users\Admin\AppData\Local\Temp\WaveGeneratorApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\WaveGeneratorApp.exe
  "C:\Users\Admin\AppData\Local\Temp\WaveGeneratorApp.exe"
  2⤵
  - Loads dropped DLL
  PID:2848

C:\Users\Admin\AppData\Local\Temp\_MEI19042\python311.dll

Filesize
1.6MB

MD5
c3de98791123bb12b315e2b4ce408d3b

SHA1
95c36944c9a4e8bb05a32e882835cac9c030c053

SHA256
98a51eca014369411df0980acbc16207d0de76c8adcd67fc27e1aa5e2f7731bb

SHA512
91651c0d5a1f55d296791aedb1594fe6b546dd16b7801af1ffa580486c99421f156ac86ccd5e22eacb7ad93fe8d3d909d50c9cc013e2618a29db8bf22183f9bc

Download Submit
memory/2848-53-0x000007FEF6110000-0x000007FEF66F9000-memory.dmp

Filesize
5.9MB

Download