dbcad9d73a4a7b3bcf63122cc4dbb44a68f7af6e818c5d69802ebb150ba5c207

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 10:38

Target

Built.exe
Size

7.5MB
MD5

8785ce235de3c76deefe56b9251c1a13
SHA1

b4da04cbaa3da390d2e6bb6207dc160d79e6a997
SHA256

dbcad9d73a4a7b3bcf63122cc4dbb44a68f7af6e818c5d69802ebb150ba5c207
SHA512

c8d7267e09075c420c50310542f64e4dc09f348c3beea55d30e967eccd2e5dbdc88accb51fd5ed23b19e48614c260a53e6051813c2f0e63b64d005caf1cbe173
SSDEEP

196608:NBQCwuL+YurErvI9pWjgN3ZdahF0pbH1AY7CtQsNI/Sx3C10:YdYurEUWjqeWxA6nAY0

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2360	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019377-21.dat	upx
behavioral1/memory/2360-23-0x000007FEF5B50000-0x000007FEF6214000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2360	1628	Built.exe	30
PID 1628 wrote to memory of 2360	1628	Built.exe	30
PID 1628 wrote to memory of 2360	1628	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2360

C:\Users\Admin\AppData\Local\Temp\_MEI16282\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/2360-23-0x000007FEF5B50000-0x000007FEF6214000-memory.dmp

Filesize
6.8MB

Download