bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33

Resubmissions

02-11-2024 19:58

02-11-2024 18:47

02-11-2024 18:07

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-11-2024 18:07

Target

NUC8O_Built.exe
Size

6.0MB
MD5

3db86ec69e4f0a8aef05ddd9fe6f9a23
SHA1

4f736d7bde4f466646654b33a01f565e47952a6a
SHA256

bd55b145c14fb0f7912bb0b2450acb9af6076d27590b86d6ddaef55d5c18ef33
SHA512

611443252d6a07423124f9ff5bbd57967e1ef4390647fd87c543a7a3ff4f86a64848fccdba33c9d97fa6fe951491ce80746cc31b862f128c2cd4a9999f30c241
SSDEEP

98304:aEDEtdFB489amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RSOLP0G5qYyO:aEaFi8YeN/FJMIDJf0gsAGK4RJLP0gqC

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2464	NUC8O_Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a445-21.dat	upx
behavioral1/memory/2464-23-0x000007FEF5D60000-0x000007FEF61CE000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2464	2984	NUC8O_Built.exe	30
PID 2984 wrote to memory of 2464	2984	NUC8O_Built.exe	30
PID 2984 wrote to memory of 2464	2984	NUC8O_Built.exe	30

C:\Users\Admin\AppData\Local\Temp\NUC8O_Built.exe
"C:\Users\Admin\AppData\Local\Temp\NUC8O_Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\NUC8O_Built.exe
  "C:\Users\Admin\AppData\Local\Temp\NUC8O_Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2464

C:\Users\Admin\AppData\Local\Temp\_MEI29842\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
memory/2464-23-0x000007FEF5D60000-0x000007FEF61CE000-memory.dmp

Filesize
4.4MB

Download