55d21708540e925ffb25abf609da46bbbc55774420b717ee8379b5178fc37a02

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 08:10

Target

chrisisalarp.exe
Size

6.8MB
MD5

2a60833af3c85c09351e169ca3e22c02
SHA1

d9067d6ed02aeaa5ee2ce3b1315d278fa57f7a10
SHA256

55d21708540e925ffb25abf609da46bbbc55774420b717ee8379b5178fc37a02
SHA512

ff91b0f5d8c67db2a5e835d677a4c1f3ef89b357f0a765120e2eb7e53e422c489986b52f02f802a7bc7333121eb76c5dda84bbe434caa71fba917f74f4ff8500
SSDEEP

98304:wdkwN+MdA5wqMFU8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DoDZDJ1n6hBnLn8:wdV1f1B6ylnlPzf+JiJCsmFMvcn6hVvA

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2708	chrisisalarp.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a05a-21.dat	upx
behavioral1/memory/2708-23-0x000007FEF63E0000-0x000007FEF69CA000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2708	2080	chrisisalarp.exe	30
PID 2080 wrote to memory of 2708	2080	chrisisalarp.exe	30
PID 2080 wrote to memory of 2708	2080	chrisisalarp.exe	30

C:\Users\Admin\AppData\Local\Temp\chrisisalarp.exe
"C:\Users\Admin\AppData\Local\Temp\chrisisalarp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\chrisisalarp.exe
  "C:\Users\Admin\AppData\Local\Temp\chrisisalarp.exe"
  2⤵
  - Loads dropped DLL
  PID:2708

C:\Users\Admin\AppData\Local\Temp\_MEI20802\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2708-23-0x000007FEF63E0000-0x000007FEF69CA000-memory.dmp

Filesize
5.9MB

Download