bfc3f0bae22eb2953e3c853389d4a086fda1232dd1bacd0af2ddb470f2f47727

Analysis

max time kernel
70s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 17:07

Target

cracker.exe
Size

10.0MB
MD5

703feb5fbaf00c7ad974ef9fbb4a3245
SHA1

a80c349ccc0affd70f9eddaefa6a4c60d42bd1c5
SHA256

bfc3f0bae22eb2953e3c853389d4a086fda1232dd1bacd0af2ddb470f2f47727
SHA512

0f827ac29ec4398c21b5b68119a859d96287242f1db01a5e86f439c41e15617da12a25b7c592ed13b363973a82543f323682c763e3426d298f7fb284e529faab
SSDEEP

196608:8FunqZ67wfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oSd:374IH2XgHq+jq93Yos

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2804	cracker.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019d2d-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2804	1596	cracker.exe	30
PID 1596 wrote to memory of 2804	1596	cracker.exe	30
PID 1596 wrote to memory of 2804	1596	cracker.exe	30

C:\Users\Admin\AppData\Local\Temp\cracker.exe
"C:\Users\Admin\AppData\Local\Temp\cracker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\cracker.exe
  "C:\Users\Admin\AppData\Local\Temp\cracker.exe"
  2⤵
  - Loads dropped DLL
  PID:2804

C:\Users\Admin\AppData\Local\Temp\_MEI15962\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/2804-23-0x000007FEF6230000-0x000007FEF68F2000-memory.dmp

Filesize
6.8MB

Download