dc0ef149a815688e93d6eddcdc659ef6616dece29a1e73000d41d63e6e5adb31

Analysis

max time kernel
28s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 17:01

Target

Lexor.exe
Size

76.8MB
MD5

3c7d5a1ed6a37845eb0516c1bc90a638
SHA1

2ed4309a62b6cef2217b2c2ebc741aa0ecdc941c
SHA256

dc0ef149a815688e93d6eddcdc659ef6616dece29a1e73000d41d63e6e5adb31
SHA512

2ec57349c406169b58fd930ccee57023e854218f475fe0434227f5e09614dda5980ac6dbeb5bdec19b35ce9147006b44b4263f0a6a2149434305020262cfaf40
SSDEEP

1572864:7j1laWdP0hSk8IpG7V+VPhqOlE7Llh+BBZiYweyJulZUdgC7nivMazqvCZH1O3:7j1AOoSkB05awO6L+nupuu7ivMsRrO3

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1580	Lexor.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020ab1-1268.dat	upx
behavioral1/memory/1580-1270-0x000007FEF59F0000-0x000007FEF60B5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1580	2096	Lexor.exe	30
PID 2096 wrote to memory of 1580	2096	Lexor.exe	30
PID 2096 wrote to memory of 1580	2096	Lexor.exe	30

C:\Users\Admin\AppData\Local\Temp\Lexor.exe
"C:\Users\Admin\AppData\Local\Temp\Lexor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\Lexor.exe
  "C:\Users\Admin\AppData\Local\Temp\Lexor.exe"
  2⤵
  - Loads dropped DLL
  PID:1580

C:\Users\Admin\AppData\Local\Temp\_MEI20962\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/1580-1270-0x000007FEF59F0000-0x000007FEF60B5000-memory.dmp

Filesize
6.8MB

Download
memory/1580-1271-0x000007FEF59F0000-0x000007FEF60B5000-memory.dmp

Filesize
6.8MB

Download