bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 18:38

Target

bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe
Size

6.0MB
MD5

3db86ec69e4f0a8aef05ddd9fe6f9a23
SHA1

4f736d7bde4f466646654b33a01f565e47952a6a
SHA256

bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33
SHA512

611443252d6a07423124f9ff5bbd57967e1ef4390647fd87c543a7a3ff4f86a64848fccdba33c9d97fa6fe951491ce80746cc31b862f128c2cd4a9999f30c241
SSDEEP

98304:aEDEtdFB489amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RSOLP0G5qYyO:aEaFi8YeN/FJMIDJf0gsAGK4RJLP0gqC

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2548	bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000018731-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2548	3008	bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe	30
PID 3008 wrote to memory of 2548	3008	bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe	30
PID 3008 wrote to memory of 2548	3008	bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe	30

C:\Users\Admin\AppData\Local\Temp\bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe
"C:\Users\Admin\AppData\Local\Temp\bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe
  "C:\Users\Admin\AppData\Local\Temp\bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33.exe"
  2⤵
  - Loads dropped DLL
  PID:2548

C:\Users\Admin\AppData\Local\Temp\_MEI30082\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
memory/2548-23-0x000007FEF5B30000-0x000007FEF5F9E000-memory.dmp

Filesize
4.4MB

Download