bb74eeb349b280b04f90e7437f77eb53cfe209d7e4093c3ad093fc0be9817b3b

Resubmissions

30-10-2024 17:46

30-10-2024 17:05

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-10-2024 17:05

Target

Prankscript.exe
Size

69.0MB
MD5

2e5ec8b0a8af16b1d042367a86981938
SHA1

ecbacf37eefdf1154aef164b81b4242c96f13777
SHA256

bb74eeb349b280b04f90e7437f77eb53cfe209d7e4093c3ad093fc0be9817b3b
SHA512

fdacab5917ec8d3796f7382ca19fb932eb4f40ea07614229a7bfc57cfeacbb24c930b2857a59ccfb0a790e74cf465b009cefaf06fb17f9a250380871dc3f679f
SSDEEP

196608:bWfQecp8urErvI9pWjgN3ZdahF0pbH1AYfTRtQPCsZp/AA81s:Pp8urEUWjqeWxRR6zppas

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2800	Prankscript.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019261-22.dat	upx
behavioral1/memory/2800-24-0x000007FEF5BA0000-0x000007FEF6264000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2800	1640	Prankscript.exe	30
PID 1640 wrote to memory of 2800	1640	Prankscript.exe	30
PID 1640 wrote to memory of 2800	1640	Prankscript.exe	30

C:\Users\Admin\AppData\Local\Temp\Prankscript.exe
"C:\Users\Admin\AppData\Local\Temp\Prankscript.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\Prankscript.exe
  "C:\Users\Admin\AppData\Local\Temp\Prankscript.exe"
  2⤵
  - Loads dropped DLL
  PID:2800

C:\Users\Admin\AppData\Local\Temp\_MEI16402\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/2800-24-0x000007FEF5BA0000-0x000007FEF6264000-memory.dmp

Filesize
6.8MB

Download