adba4cdf8934918375e707312fef6a00a6b057105baade9f405ad52db4a34343

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 14:22

Target

Bloxstrap-v2.8.1.exe
Size

39.1MB
MD5

73bb2376a421ae95bd80ba771aa12a8d
SHA1

80f0bf687745df6be5d020d7b02eb7d3688276e2
SHA256

adba4cdf8934918375e707312fef6a00a6b057105baade9f405ad52db4a34343
SHA512

35794af776229cd986428ad5fed0e68d6756233a4c4a440858c6eff087fc2a75dc96039b67a27ba25807369942d3f70fe4ecc1cb434bcf1d87f794f07067da79
SSDEEP

786432:mVl8ZGKlI8+W8YHiBtAjwlaOizcY87HC5glynXAWtXeRplFGdlQRba:xGKlKWLHe0BlE7plilerlFGdgb

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2864	Bloxstrap-v2.8.1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020afb-1159.dat	upx
behavioral1/memory/2864-1161-0x000007FEF59F0000-0x000007FEF5FD9000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2864	2876	Bloxstrap-v2.8.1.exe	30
PID 2876 wrote to memory of 2864	2876	Bloxstrap-v2.8.1.exe	30
PID 2876 wrote to memory of 2864	2876	Bloxstrap-v2.8.1.exe	30

C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.8.1.exe"
  2⤵
  - Loads dropped DLL
  PID:2864

C:\Users\Admin\AppData\Local\Temp\_MEI28762\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/2864-1161-0x000007FEF59F0000-0x000007FEF5FD9000-memory.dmp

Filesize
5.9MB

Download