Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    14-11-2024 08:58

General

  • Target

    d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe

  • Size

    5.9MB

  • MD5

    6b21dfb8d2ebee9dd351b642ef62f738

  • SHA1

    c41bd9e47eebd0dbde150c80862e95925003de33

  • SHA256

    d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7

  • SHA512

    16789e3b8eff941655667f50c87d3e43b27f9f7fa46f90585933cec84f55fb7db368db1647d3d4703517a042f579f2e7d081080eced995ff03206da646d6d250

  • SSDEEP

    98304:FUmoDUN43WEqGjOjFgFEblNHYSxTpirSHcUR43zWwkdA8QJCKC7bN3mb6aVtMF1v:FUumWE9OjmFwDRxtYSHdK3rkdai7bN3x

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe
    "C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe
      "C:\Users\Admin\AppData\Local\Temp\d42ba9148efbf042a47ba86704e89212e3f18b6cbcb434e03d771710e58166e7.exe"
      2⤵
      • Loads dropped DLL
      PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\_MEI28882\python310.dll

    Filesize

    1.4MB

    MD5

    4a6afa2200b1918c413d511c5a3c041c

    SHA1

    39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

    SHA256

    bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

    SHA512

    dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

  • memory/2316-23-0x000007FEF6D40000-0x000007FEF71A6000-memory.dmp

    Filesize

    4.4MB