Analysis

  • max time kernel
    121s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 13:23

General

  • Target

    inv gift checker/Inv Checker V1.exe

  • Size

    29.0MB

  • MD5

    120b21d469ef84be2abc2e945d1e5583

  • SHA1

    a82e93991cf04368939f2849c12e1c05540251e9

  • SHA256

    af4062e1126ed2ff06070e36adb2a12c25b83918991c8ef9259df9cafc0c5ea1

  • SHA512

    b10f2ecdf07a57d3dd4b158be461ad2fe84d8a75effaae2aada7b420f0c6b809d0949387d89b4b224652c4d0e462ca3013bcb4c7afd5461f6fad15f649127cf9

  • SSDEEP

    393216:Ma92Yg5rgYStSdurEUWj2EnBSVkRIrY87oAKESWhUBKdu2lOoGezRKOUDEPjcZYj:/9SbEsdbzzcY87oJESWqESrDRYyLK0g

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V1.exe
    "C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V1.exe
      "C:\Users\Admin\AppData\Local\Temp\inv gift checker\Inv Checker V1.exe"
      2⤵
      • Loads dropped DLL
      PID:1716

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI30442\python312.dll

          Filesize

          1.7MB

          MD5

          7ef625a8207c1a1a46cb084dfc747376

          SHA1

          8cc35164b7cda0ed43eb07fdb1ea62c23ae1b6f9

          SHA256

          c49c511fa244815cc1ab62a4dab0a4a0ffc0a1b99ac9333f60a3f795b99f65ed

          SHA512

          0872033ee3dc46066db3a44693d3802b5d158ef9e0481d1e33275934800cea6a79870ac0776a85f113daa67d9629b6d8bc67cea3d2a99445114140de1c29e5a4

        • memory/1716-713-0x000007FEF6210000-0x000007FEF68D5000-memory.dmp

          Filesize

          6.8MB