5ac330c2269dc7ea56de437e3fa0c4d1705727bc2e97a90261759b06bea89872

Resubmissions

07-11-2024 17:59

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 17:59

Target

matchaa.exe
Size

81.2MB
MD5

9a4c93d17d3544cead929c360f79a775
SHA1

fab2faa26c56c7aa5575eb602e151ea1f1b95661
SHA256

5ac330c2269dc7ea56de437e3fa0c4d1705727bc2e97a90261759b06bea89872
SHA512

6adc587d09b021c35f037aaaa8b600c5ff96fc7ff75c1d2e3b152076a11f9762cea7d37303bcdeceb2950c221e193cac32b89cfc97896fc1afb1c58076a884bc
SSDEEP

1572864:MGKlEWpO0hSk8IpG7V+VPhqYdfmE7cliwiYgj+h58sMw/y0mDSiwJq:NKewbSkB05awcf0wy5DyX7

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2776	matchaa.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020aa2-1264.dat	upx
behavioral1/memory/2776-1266-0x000007FEF6240000-0x000007FEF6832000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2776	2512	matchaa.exe	31
PID 2512 wrote to memory of 2776	2512	matchaa.exe	31
PID 2512 wrote to memory of 2776	2512	matchaa.exe	31

C:\Users\Admin\AppData\Local\Temp\matchaa.exe
"C:\Users\Admin\AppData\Local\Temp\matchaa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\matchaa.exe
  "C:\Users\Admin\AppData\Local\Temp\matchaa.exe"
  2⤵
  - Loads dropped DLL
  PID:2776

C:\Users\Admin\AppData\Local\Temp\_MEI25122\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/2776-1266-0x000007FEF6240000-0x000007FEF6832000-memory.dmp

Filesize
5.9MB

Download