a4d7d7e050416f31dda4fbd8c4219a00034a5243d11e17a1140366945ea152f4

Analysis

max time kernel
147s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/11/2024, 21:12

Target

Volcanoids.exe
Size

7.9MB
MD5

b6d0f8c741f0ac0417936e870e6e670a
SHA1

5663e0502ac36a6c956ee140bcee787d8ffd8d3e
SHA256

a4d7d7e050416f31dda4fbd8c4219a00034a5243d11e17a1140366945ea152f4
SHA512

797ffcca07cf9b9e9d1d6321c735f62a3a3ee4d41ce6a3864ff080caed5af31aaefa0866f7efea69d79b4621325f206468ec9b14a406c0cae86583a97d5da0d8
SSDEEP

196608:dQHYw43wfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jW:jcIHziK1piXLGVE4Ue0VJS

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2680	Volcanoids.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019f47-22.dat	upx
behavioral1/files/0x0005000000019f47-23.dat	upx
behavioral1/memory/2680-24-0x000007FEF64A0000-0x000007FEF6B03000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2680	2656	Volcanoids.exe	30
PID 2656 wrote to memory of 2680	2656	Volcanoids.exe	30
PID 2656 wrote to memory of 2680	2656	Volcanoids.exe	30

C:\Users\Admin\AppData\Local\Temp\Volcanoids.exe
"C:\Users\Admin\AppData\Local\Temp\Volcanoids.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\Volcanoids.exe
  "C:\Users\Admin\AppData\Local\Temp\Volcanoids.exe"
  2⤵
  - Loads dropped DLL
  PID:2680

C:\Users\Admin\AppData\Local\Temp\_MEI26562\python313.dll

Filesize
1.4MB

MD5
7bfef7ed9db4e2d27396467dd3fb6b2f

SHA1
4def212d01e6020f225eaa573273fe409b010313

SHA256
308655e5172ebbb8727b6f33b47b37c42bb9162e8ee8bdf2bc288b65da1b41f9

SHA512
61fb91d0018b5a14cd1c74dc5fa2b0ddbad47ee424136f5f23b472fee94130c663026feeb1497ac270a278b8a80f4c68bb8a60eb0b6b8dafa29a0a978bb00950

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI26562\python313.dll

Filesize
1.5MB

MD5
ef08b66791063f22cb705d2d2648ee23

SHA1
e2a952f3cd39106c1fc6efeba4de39f1306921de

SHA256
238600552c3cd98659d1b331bb5974245ee0289f16f10c597d7922ee51fe8fa3

SHA512
9048aa01b1c9ae3c501fff87da0dc920fd05ccd18fcb0bdeb69dc1eb0f8472709f51f4072806de7298889bd68b3392fab03f0802e7ce61ce42c18032b03aec11

Download Submit
memory/2680-24-0x000007FEF64A0000-0x000007FEF6B03000-memory.dmp

Filesize
6.4MB

Download