83f5a2f68b73babb2f3b9c137294b41ae8280dbaf2a75cceb42999f375879f00

Analysis

max time kernel
1561s
max time network
1562s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 21:18

Target

YSL.exe
Size

10.0MB
MD5

0d54621031cdffa9009dd1c4dfae318e
SHA1

04184d399768d18c34de851f20cd0295dca1374c
SHA256

83f5a2f68b73babb2f3b9c137294b41ae8280dbaf2a75cceb42999f375879f00
SHA512

8b6d5f839f49a886b352f7071d2f9ad3c42099d387728feb7002e6e2b281f3ef5f0f0079823a7c957d33a61879819ee68bd7ce75e5b3323d8461c08d929936ef
SSDEEP

196608:BngVVE0wfI9jUC2gYBYv3vbW2+iITx1U6n6:yVVELIH2gYBgDWJTnz6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2708	YSL.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019229-21.dat	upx
behavioral1/memory/2708-23-0x000007FEF5170000-0x000007FEF5835000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2708	1820	YSL.exe	31
PID 1820 wrote to memory of 2708	1820	YSL.exe	31
PID 1820 wrote to memory of 2708	1820	YSL.exe	31

C:\Users\Admin\AppData\Local\Temp\YSL.exe
"C:\Users\Admin\AppData\Local\Temp\YSL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\YSL.exe
  "C:\Users\Admin\AppData\Local\Temp\YSL.exe"
  2⤵
  - Loads dropped DLL
  PID:2708

C:\Users\Admin\AppData\Local\Temp\_MEI18202\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2708-23-0x000007FEF5170000-0x000007FEF5835000-memory.dmp

Filesize
6.8MB

Download