a42c68fe69b216f425e374613a373a834298e366645b7b0cd1ffab7a7d6cab91

Analysis

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29-10-2024 14:28

Target

Built.exe
Size

6.0MB
MD5

41cb920d7fa5aed46820086641d53731
SHA1

a373754c02dc269cc380152f8231109c7bdf01a9
SHA256

a42c68fe69b216f425e374613a373a834298e366645b7b0cd1ffab7a7d6cab91
SHA512

879aedcaf0f24883bd9221f257ac39ab7bef8dcd01053034b7a96d9a3f6c2fc51ebf4002bc647f143b7acadb579dd4c270d8850736091334e6b169d0db397713
SSDEEP

98304:W0EtdFBCIFTamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RzOLPH4n88fT:WjFIIFWeN/FJMIDJf0gsAGK4RyLPHx87

Score

7^/10

upx

Loads dropped DLL 2 IoCs

pid	Process
4188	Built.exe
4188	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x001900000002aab8-21.dat	upx
behavioral1/memory/4188-25-0x00007FFEC3600000-0x00007FFEC3A6E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4188	3956	Built.exe	76
PID 3956 wrote to memory of 4188	3956	Built.exe	76

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:4188

C:\Users\Admin\AppData\Local\Temp\_MEI39562\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39562\base_library.zip

Filesize
106KB

MD5
b5d486521b8eaec53615b15c30b664e6

SHA1
a3be89677e2a125f261f8767e9bff861223a088b

SHA256
010b18ba47b8551ef53d055446cd7f36a197bd2d2d9f574d516dbf3d4f5d1ae0

SHA512
fa33551402471bef97aaf4455a026fc1702eeb619b6a82089ec26534e9830ab82ac236c5b7768371aac1d31992bea1824a33452b1ddfc616ab5c6be23dee54c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39562\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
memory/4188-25-0x00007FFEC3600000-0x00007FFEC3A6E000-memory.dmp

Filesize
4.4MB

Download