562f669dd804b59934e61e07455c2fc4b5be3d7060f8ce5447244e50a444f695

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-11-2024 17:59

Target

main.exe
Size

37.5MB
MD5

8c8bb6c097891887fc0248221dd5e338
SHA1

1768fda5862236c84c1f37855f09daa48406f524
SHA256

562f669dd804b59934e61e07455c2fc4b5be3d7060f8ce5447244e50a444f695
SHA512

11dcedf1277f573b9a0a3f426fc1df40c579a33025e957d0fe19d43cec79559c3c8aa000d8bf0e69f0ee35485ef9f675084b815c9cdfbdefd21900f6a801f770
SSDEEP

786432:W8MdYj/rmTVKqB2cYrlyaBa5/X3QSPTvoIkQJh9cnE8pKNY:pjiTkrlyzX3QSPZDlcEmK+

Score

7^/10

upx

pid	process
2704	main.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI29162\python310.dll	upx
behavioral1/memory/2704-14-0x000007FEF6390000-0x000007FEF67F6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

main.exe

description	pid	process	target process
PID 2916 wrote to memory of 2704	2916	main.exe	main.exe
PID 2916 wrote to memory of 2704	2916	main.exe	main.exe
PID 2916 wrote to memory of 2704	2916	main.exe	main.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  PID:2704

C:\Users\Admin\AppData\Local\Temp\_MEI29162\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/2704-14-0x000007FEF6390000-0x000007FEF67F6000-memory.dmp

Filesize
4.4MB

Download