87ed23b4639c7ad635236ebeb98376a4cd24c25382e2be7d49cd5066e4b53b85

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 15:35

Target

Disabler.exe
Size

7.5MB
MD5

a3aead8cd0dbd2c03bf5a6b8b5b6b73d
SHA1

03fb8c5f2728479060249bc1f2988efe34e71499
SHA256

87ed23b4639c7ad635236ebeb98376a4cd24c25382e2be7d49cd5066e4b53b85
SHA512

ac38156a781bdceeb7975830c159327df3d92aacc6b7f9dce54294df6f971c981ad762b1475ac6d676e949e457259884ceff3491ddc9b5141c98a6c8744487b5
SSDEEP

196608:D7hhOourErvI9pWjg/Qc+4o673pNrabenyzWtPMYnNcsk:jrurEUWjZZ4dDLIeyzWtPTNzk

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2136	Disabler.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000192f0-21.dat	upx
behavioral1/memory/2136-23-0x000007FEF61E0000-0x000007FEF68A5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2136	2496	Disabler.exe	30
PID 2496 wrote to memory of 2136	2496	Disabler.exe	30
PID 2496 wrote to memory of 2136	2496	Disabler.exe	30

C:\Users\Admin\AppData\Local\Temp\Disabler.exe
"C:\Users\Admin\AppData\Local\Temp\Disabler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\Disabler.exe
  "C:\Users\Admin\AppData\Local\Temp\Disabler.exe"
  2⤵
  - Loads dropped DLL
  PID:2136

C:\Users\Admin\AppData\Local\Temp\_MEI24962\python312.dll

Filesize
1.7MB

MD5
eb02b8268d6ea28db0ea71bfe24b15d6

SHA1
86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

SHA256
80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

SHA512
693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

Download Submit
memory/2136-23-0x000007FEF61E0000-0x000007FEF68A5000-memory.dmp

Filesize
6.8MB

Download