0db285592d8a1b6eee8489e5b94a43411d7d3e79b4962a9b64cbf50b145ba0be

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 19:48

Target

AltManager.exe
Size

7.6MB
MD5

e91247c97072a670b26ec79ab04c632d
SHA1

f757155cc708b6aa66983369ae552bf9dd3a0f36
SHA256

0db285592d8a1b6eee8489e5b94a43411d7d3e79b4962a9b64cbf50b145ba0be
SHA512

74a6e815e843a16977661aaf585336d22cc1001dbe3efecbd35a9571da02ac90f0e91dec8bdf0b52f28d4ce4b90b3bf051530468788c911c49d3da67332ac2c7
SSDEEP

196608:NFHYSwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jk:OIHziK1piXLGVE4Ue0VJA

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

AltManager.exe

pid	Process
2692	AltManager.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x0006000000018be7-21.dat	upx
behavioral1/memory/2692-23-0x000007FEF6170000-0x000007FEF67D3000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

AltManager.exe

description	pid	Process	procid_target
PID 1204 wrote to memory of 2692	1204	AltManager.exe	30
PID 1204 wrote to memory of 2692	1204	AltManager.exe	30
PID 1204 wrote to memory of 2692	1204	AltManager.exe	30

C:\Users\Admin\AppData\Local\Temp\AltManager.exe
"C:\Users\Admin\AppData\Local\Temp\AltManager.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\AltManager.exe
  "C:\Users\Admin\AppData\Local\Temp\AltManager.exe"
  2⤵
  - Loads dropped DLL
  PID:2692

C:\Users\Admin\AppData\Local\Temp\_MEI12042\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
memory/2692-23-0x000007FEF6170000-0x000007FEF67D3000-memory.dmp

Filesize
6.4MB

Download