d13b50e2bcf90995477010372b0170eebb6830adcbc55e36d038a7286e329bbd

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-11-2024 04:02

Target

setup.exe
Size

9.8MB
MD5

4d563c46d8553f7d2b7551dd17541821
SHA1

53746b017cba01648f4efd81c620feab96c8316f
SHA256

d13b50e2bcf90995477010372b0170eebb6830adcbc55e36d038a7286e329bbd
SHA512

473a634d531b56018405d6648c9314f7d63dd9077ef51fdf3bb2c211aeed0cf7ef1851423d457be0188ddbfa40a8af8ba4a309dfe2eb595ac381e48da63865b4
SSDEEP

196608:14HuwpeVWzdppWh9ydVG9eNVYFJMIDJ+gsAGKpRRErxkYK:syyde98+Fqy+gsiREN

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2244	setup.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000194fc-48.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2244	2792	setup.exe	30
PID 2792 wrote to memory of 2244	2792	setup.exe	30
PID 2792 wrote to memory of 2244	2792	setup.exe	30

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Loads dropped DLL
  PID:2244

C:\Users\Admin\AppData\Local\Temp\_MEI27922\python310.dll

Filesize
1.4MB

MD5
196deb9a74e6e9e242f04008ea80f7d3

SHA1
a54373ebad306f3e6f585bcdf1544fbdcf9c0386

SHA256
20b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75

SHA512
8c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68

Download Submit
memory/2244-50-0x000007FEF6530000-0x000007FEF699E000-memory.dmp

Filesize
4.4MB

Download