fc4dd1f0bc745d3960e6664d594cc7f2063bc41e9c5174b897d07af9543a408d

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 08:04

Target

EXMPremiumTweakingUtility.exe
Size

9.4MB
MD5

7982f668b61468db933f47c6070cdf67
SHA1

cbe1c9aaf057304083db74c481d14447d5392d43
SHA256

2e3c177593b57ab54f63738dd1735da0913fc5267db43e8aeb7e3f332a2eb81a
SHA512

9430d3a951096eb1d16807091a2cac9e6d564b386639f08ef3222d489824a0b2be8bdb9678238037608b535eacf9fd7f251b80a9b9e5557a06b9c3f8072440c0
SSDEEP

196608:TBtx/R5xriFC5XdxgV7vsAWtDEupleXfMpTo2wIigoQhuxJ4V/D/3J/g6f9H:TzVeuEhvsA5ufBhopIqOu

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2656	EXMPremiumTweakingUtility.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000400000001d7ba-22.dat	upx
behavioral1/memory/2656-24-0x000007FEF60A0000-0x000007FEF6505000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2656	1084	EXMPremiumTweakingUtility.exe	30
PID 1084 wrote to memory of 2656	1084	EXMPremiumTweakingUtility.exe	30
PID 1084 wrote to memory of 2656	1084	EXMPremiumTweakingUtility.exe	30

C:\Users\Admin\AppData\Local\Temp\EXMPremiumTweakingUtility.exe
"C:\Users\Admin\AppData\Local\Temp\EXMPremiumTweakingUtility.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\EXMPremiumTweakingUtility.exe
  "C:\Users\Admin\AppData\Local\Temp\EXMPremiumTweakingUtility.exe"
  2⤵
  - Loads dropped DLL
  PID:2656

C:\Users\Admin\AppData\Local\Temp\_MEI10842\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/2656-24-0x000007FEF60A0000-0x000007FEF6505000-memory.dmp

Filesize
4.4MB

Download