f967660afa6c074af705058bd0e681c5a431e705b83149c6e54f5b04797ded19

Analysis

max time kernel
90s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-11-2024 17:53

Target

loader.exe
Size

7.4MB
MD5

e26f980e01937c11753a44cba974b75d
SHA1

31b41b9a017dd34b971c32565c612aa10b3e98c3
SHA256

f967660afa6c074af705058bd0e681c5a431e705b83149c6e54f5b04797ded19
SHA512

df8db54b06d8abaa5c25cf0dfd94fafe5662f55edebb7c60755bbeeafc73a3ef72b694a646635dd592e9af355f3533d2818528bc673a2f43e6a04a38239c9b69
SSDEEP

196608:cWxteurErvI9pWjgaAnajMsK23fQC//OoLxh:zteurEUWjJjYoo4jLxh

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2892	loader.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c3c-21.dat	upx
behavioral1/memory/2892-23-0x000007FEF5E10000-0x000007FEF64D5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2892	2464	loader.exe	30
PID 2464 wrote to memory of 2892	2464	loader.exe	30
PID 2464 wrote to memory of 2892	2464	loader.exe	30

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Loads dropped DLL
  PID:2892

C:\Users\Admin\AppData\Local\Temp\_MEI24642\python312.dll

Filesize
1.7MB

MD5
fb8bedf8440eb432c9f3587b8114abc0

SHA1
136bb4dd38a7f6cb3e2613910607131c97674f7c

SHA256
cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6

SHA512
b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63

Download Submit
memory/2892-23-0x000007FEF5E10000-0x000007FEF64D5000-memory.dmp

Filesize
6.8MB

Download