c0a3974d6029fd96b68a40c3fe56c56868a1c68ef9a128ae7d9c24ddc5785c5b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 03:27

Target

VytrixDuper.exe
Size

22.8MB
MD5

d13ae015a085b21c90f987ed36574e2d
SHA1

2488d03a0b5f72153c89089536d8c2d27527e973
SHA256

c0a3974d6029fd96b68a40c3fe56c56868a1c68ef9a128ae7d9c24ddc5785c5b
SHA512

29e0d67b71ac7aec66de9b38edeea15159e50fa7a4d96925dc578ab5ae7f31509716a7b15eadb7e1eeb614762332ca95692eb423488912b3bd9bd28c6a07601c
SSDEEP

393216:uJ/+tByxjBIn8iK1piXLGVEgMv0XXsgyYWZBo:DtAjhDiXHjvmYBo

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

VytrixDuper.exe

pid process

264 VytrixDuper.exe

pid	process
264	VytrixDuper.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI27242\python313.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

VytrixDuper.exe

description	pid	process	target process
PID 2724 wrote to memory of 264	2724	VytrixDuper.exe	VytrixDuper.exe
PID 2724 wrote to memory of 264	2724	VytrixDuper.exe	VytrixDuper.exe
PID 2724 wrote to memory of 264	2724	VytrixDuper.exe	VytrixDuper.exe

C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe
"C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe
  "C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe"
  2⤵
  - Loads dropped DLL
  PID:264

C:\Users\Admin\AppData\Local\Temp\_MEI27242\python313.dll

Filesize
1.8MB

MD5
d99ac8bac1343105b642295397ca2ffc

SHA1
93fd73c1fb9ee99ddc66d38885a657cf81f62836

SHA256
9116e56cedeb1c4ae82b4bde560f2fe0b83a16764865012cbf5501673d3c5536

SHA512
89d30bc84978daf469008ffc347cbd3e189f1df2c1a302dedfc2b700267cc28c671c7c35b5e95ba29a300e7fda75ccfc720d2173ea6db6eb69978772c0b8339f

Download Submit
memory/264-63-0x000007FEF5200000-0x000007FEF5863000-memory.dmp

Filesize
6.4MB

Download