4cde070878f0c3ca755db836b206cde36980d508b932274810de0d4daaaa2306

Resubmissions

05-11-2024 18:05

241105-wpnbcawgnr 10

05-11-2024 18:05

241105-wpbbsaylam 10

05-11-2024 16:25

241105-tw6edsxjhl 10

05-11-2024 15:32

241105-sywgjavapj 10

Analysis

max time kernel
19s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-11-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Built(1).exe
Size

7.5MB
MD5

c9e9db948eeeece5252f031b19d0e735
SHA1

3c8df3b2c86fa21d411fbb4095df323ae4c7389e
SHA256

4cde070878f0c3ca755db836b206cde36980d508b932274810de0d4daaaa2306
SHA512

69ffb3c3898b006bf4b2e8e69fac342527242bcae2c5fb29fe702b4603c6493148d47a48f508a9c8a75f68083114bfec618ddc97f4591993284be532cfc6c5ca
SSDEEP

196608:7uQCwVE67urErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC17:PVf7urEUWjqeWx06rYY7

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2924	Built(1).exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a020-21.dat	upx
behavioral1/memory/2924-23-0x000007FEF66F0000-0x000007FEF6DB4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2924	2668	Built(1).exe	30
PID 2668 wrote to memory of 2924	2668	Built(1).exe	30
PID 2668 wrote to memory of 2924	2668	Built(1).exe	30

C:\Users\Admin\AppData\Local\Temp\Built(1).exe
"C:\Users\Admin\AppData\Local\Temp\Built(1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\Built(1).exe
  "C:\Users\Admin\AppData\Local\Temp\Built(1).exe"
  2⤵
  - Loads dropped DLL
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI26682\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/2924-23-0x000007FEF66F0000-0x000007FEF6DB4000-memory.dmp

Filesize
6.8MB

Download
memory/2924-24-0x000007FEF66F0000-0x000007FEF6DB4000-memory.dmp

Filesize
6.8MB

Download