86cde2d508fd21a8bc6b07be3a4aecdc1b0ea403535b38a4f59bba82c0d7172d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-10-2024 14:08

Target

Videotool.exe
Size

7.5MB
MD5

6a4cdfa563d9e187d86e3f95345af036
SHA1

5319190f5f82b9bfbf15ced2d3f8eea777aa5f46
SHA256

86cde2d508fd21a8bc6b07be3a4aecdc1b0ea403535b38a4f59bba82c0d7172d
SHA512

e225d7ad74845fe8dfaa2e0ad9f721f80df8701d051ccb8585078e2fcdc13c18b536c62a2e6da72bf1629d400c5e6c2815a09cd3afcea868c3b768397df56228
SSDEEP

196608:dkgFbcpwfI9jUC2gYBYv3vbW5+iITm1U6fl:TFbTIH2gYBgDW4TOzd

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
600	Videotool.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000193d4-21.dat	upx
behavioral1/memory/600-23-0x000007FEF6170000-0x000007FEF6835000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 600	876	Videotool.exe	31
PID 876 wrote to memory of 600	876	Videotool.exe	31
PID 876 wrote to memory of 600	876	Videotool.exe	31

C:\Users\Admin\AppData\Local\Temp\Videotool.exe
"C:\Users\Admin\AppData\Local\Temp\Videotool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Users\Admin\AppData\Local\Temp\Videotool.exe
  "C:\Users\Admin\AppData\Local\Temp\Videotool.exe"
  2⤵
  - Loads dropped DLL
  PID:600

C:\Users\Admin\AppData\Local\Temp\_MEI8762\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/600-23-0x000007FEF6170000-0x000007FEF6835000-memory.dmp

Filesize
6.8MB

Download