5aed83acf628eed3ff847989ef9cf1b76cccd5a844d3224661b90db7278ec62a

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 17:03

Target

falcontemp.exe
Size

5.9MB
MD5

b9410fa310e4031d27fba74278b8bfa8
SHA1

cdce35a0cc9ee3c4dad5d9bcfe06714f2aa8f97d
SHA256

5aed83acf628eed3ff847989ef9cf1b76cccd5a844d3224661b90db7278ec62a
SHA512

5b4d4487f03c9432b5a0fdf6a83c80a7f4696b73fe8c37d673d3db5d695a73897391c5f8fd43703b33fccb143d63fb629b85fdc58fa0f9b5b76c2f5c90f2107c
SSDEEP

98304:Pg+WCSti65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFx9hEkrPF/iv3:Pzm/DOYjJlpZstQoS9Hf12VKXmbEC4V9

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2328	falcontemp.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000187a5-21.dat	upx
behavioral1/memory/2328-23-0x000007FEF59E0000-0x000007FEF5E45000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2328	1972	falcontemp.exe	30
PID 1972 wrote to memory of 2328	1972	falcontemp.exe	30
PID 1972 wrote to memory of 2328	1972	falcontemp.exe	30

C:\Users\Admin\AppData\Local\Temp\falcontemp.exe
"C:\Users\Admin\AppData\Local\Temp\falcontemp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\falcontemp.exe
  "C:\Users\Admin\AppData\Local\Temp\falcontemp.exe"
  2⤵
  - Loads dropped DLL
  PID:2328

C:\Users\Admin\AppData\Local\Temp\_MEI19722\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/2328-23-0x000007FEF59E0000-0x000007FEF5E45000-memory.dmp

Filesize
4.4MB

Download