2759da6727291b8941a0675d5352ea1fad153ffd9f0bd447a0a96433ac94a906

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/11/2024, 20:47

Target

06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe
Size

7.3MB
MD5

d99f4643fa07fa48ee5c7e700b0fd033
SHA1

139f0f1734c268d9fe5154421ca1d6b6db5ffd4a
SHA256

06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3
SHA512

18420badfdac5fcd3b9c8d9b5e4cf364f686d59e22ad3ff44b599d40d3750740e06b63b5e4b52c2c2cae07ac244705dc412828dfcda5aff64bb4cc33a3458ab8
SSDEEP

196608:Am8PDiLjv+bhqNVoB0SEsucQZ41JBbIg11tdJG:Z8PaL+9qz80SJHQK1JV1vDG

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2052	06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001925e-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2052	2352	06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe	30
PID 2352 wrote to memory of 2052	2352	06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe	30
PID 2352 wrote to memory of 2052	2352	06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe	30

C:\Users\Admin\AppData\Local\Temp\06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe
"C:\Users\Admin\AppData\Local\Temp\06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe
  "C:\Users\Admin\AppData\Local\Temp\06b28a3a05f98b3172eee3f990e1e1c3f8d51d68a39f93db09e01fd2c70439d3.exe"
  2⤵
  - Loads dropped DLL
  PID:2052

C:\Users\Admin\AppData\Local\Temp\_MEI23522\python311.dll

Filesize
1.6MB

MD5
76eb1ad615ba6600ce747bf1acde6679

SHA1
d3e1318077217372653be3947635b93df68156a4

SHA256
30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

SHA512
2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

Download Submit
memory/2052-23-0x000007FEF61A0000-0x000007FEF678E000-memory.dmp

Filesize
5.9MB

Download