82d90e090e6f565dd9f98771b6b264bb6cd16787615636767dd07e50b5194a31

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 11:45

Target

TD.premiumbeta.exe
Size

7.4MB
MD5

92be1111700fb7aa292c3802ad821847
SHA1

f0972a23e67ccdf7d3f107f199a881af177e69b2
SHA256

82d90e090e6f565dd9f98771b6b264bb6cd16787615636767dd07e50b5194a31
SHA512

f50d581c83c46869e6d0bf585f0e8a8348d84e95ba778bcf8dbae4d6dca06324367dbeab5b2fac3124b5a3a13d93d6fd872ccbdc79e8af3b5525f5ef6c704964
SSDEEP

98304:+Vp5IMc3urErvz81LpWjjUlLkvzgXO9hAlaYrzzuJZYJ1JIuIyKU78bcgPowNMs:8QurErvI9pWjgyvoaYrE41JIuIzoO9

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2904	TD.premiumbeta.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000197c1-21.dat	upx
behavioral1/memory/2904-23-0x000007FEF5840000-0x000007FEF5E30000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2904	2096	TD.premiumbeta.exe	31
PID 2096 wrote to memory of 2904	2096	TD.premiumbeta.exe	31
PID 2096 wrote to memory of 2904	2096	TD.premiumbeta.exe	31

C:\Users\Admin\AppData\Local\Temp\TD.premiumbeta.exe
"C:\Users\Admin\AppData\Local\Temp\TD.premiumbeta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\TD.premiumbeta.exe
  "C:\Users\Admin\AppData\Local\Temp\TD.premiumbeta.exe"
  2⤵
  - Loads dropped DLL
  PID:2904

C:\Users\Admin\AppData\Local\Temp\_MEI20962\python311.dll

Filesize
1.6MB

MD5
b167b98fc5c89d65cb1fa8df31c5de13

SHA1
3a6597007f572ea09ed233d813462e80e14c5444

SHA256
28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76

SHA512
40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8

Download Submit
memory/2904-23-0x000007FEF5840000-0x000007FEF5E30000-memory.dmp

Filesize
5.9MB

Download
memory/2904-44-0x000007FEF5840000-0x000007FEF5E30000-memory.dmp

Filesize
5.9MB

Download