4b06ec6ebe8bf2c37a99083e8d8f592a99572a4691aad07b22ef16d43de8494f

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 10:51

Target

ElectronV3/ElectronV3.exe
Size

37.8MB
MD5

8fe4c19f89235c08d6676afba340c5b4
SHA1

198d1576fa13ba1147b0ccf01e4aba9886ae44e3
SHA256

9372ae0dcd737e61bfa791161ece3728963129c707fe7af5cc710be56c459b79
SHA512

8e17449cf72c3dea91a5ebac6e477291d63a0341bd673fb0453c8271dc913a34dfaa87143b806e66eb704778890f187416f88615768b6df9f184955d77b584d8
SSDEEP

786432:WCXvCOtmPf155bG8YCQDf4ejpmFBa3feLeKyQh/7K4rv3Fqbd:WAvCOUX5LdSrjpmFTLEw/GUqbd

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

ElectronV3.exe

pid	Process
2784	ElectronV3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x000500000001c89f-47.dat	upx
behavioral1/memory/2784-49-0x000007FEF5D70000-0x000007FEF61D5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ElectronV3.exe

description	pid	Process	procid_target
PID 2296 wrote to memory of 2784	2296	ElectronV3.exe	30
PID 2296 wrote to memory of 2784	2296	ElectronV3.exe	30
PID 2296 wrote to memory of 2784	2296	ElectronV3.exe	30

C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2784

C:\Users\Admin\AppData\Local\Temp\_MEI22962\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2784-49-0x000007FEF5D70000-0x000007FEF61D5000-memory.dmp

Filesize
4.4MB

Download