72fdb72dcc71697b027824211e2879f4bf8c8974e56a857f2fca30ad7b675d6f

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 15:56

Target

Built.exe
Size

7.5MB
MD5

12e9f3ce18351ee539646c23cc862c5c
SHA1

0b2487fe4e3ffaf79fdf1c0c0b01f6ce68346daf
SHA256

72fdb72dcc71697b027824211e2879f4bf8c8974e56a857f2fca30ad7b675d6f
SHA512

585882cbb5e8097d47b3985326a4ae9c17d2e015801652d88a5c5230feab1add48f60bd73fa9ff34b505de742b437e53ed03b53d5011c1834c134610ff96ac59
SSDEEP

196608:yOgFHwfI9jUC2gYBYv3vbW5+iITm1U6fi:4FMIH2gYBgDW4TOz6

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2192	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001939c-21.dat	upx
behavioral1/memory/2192-23-0x000007FEF6130000-0x000007FEF67F5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2192	1964	Built.exe	28
PID 1964 wrote to memory of 2192	1964	Built.exe	28
PID 1964 wrote to memory of 2192	1964	Built.exe	28

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2192

C:\Users\Admin\AppData\Local\Temp\_MEI19642\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2192-23-0x000007FEF6130000-0x000007FEF67F5000-memory.dmp

Filesize
6.8MB

Download