a01ee230f0e539d49782c3baed27b90fa3087197e263eaa7cc5ad61ee99c889a

Resubmissions

03-11-2024 12:41

241103-pw8sasthmd 10

03-11-2024 03:46

03-11-2024 02:38

03-11-2024 02:00

03-11-2024 01:31

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built.exe
Size

6.9MB
MD5

d8d7a437b5529fd3712a046ecb9ba8e2
SHA1

abd885baa18b49646aedf394c08ecfc80b5d00ab
SHA256

a01ee230f0e539d49782c3baed27b90fa3087197e263eaa7cc5ad61ee99c889a
SHA512

bbff35c26089388ccaff3c26f2de0b4aa3dd8ac9316058f92f769755b0645df4a46a901805612e2a9829a93e274b63955c16e2f14e73151b9cd215a9ba3d4887
SSDEEP

98304:vVpRDjWM8JEE1FEIamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhE6:rR0KpeNTfm/pf+xk4dWRpmrbW3jmrH

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2988	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019d62-21.dat	upx
behavioral1/memory/2988-23-0x000007FEF6530000-0x000007FEF6B18000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2988	2496	Built.exe	31
PID 2496 wrote to memory of 2988	2496	Built.exe	31
PID 2496 wrote to memory of 2988	2496	Built.exe	31

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24962\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
memory/2988-23-0x000007FEF6530000-0x000007FEF6B18000-memory.dmp

Filesize
5.9MB

Download