25d97529fa389d0b36044fa44d7e8d80f6b00ca2d867d6d7371f5b97e088cdc2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 20:38

Target

SKIG UPDATED.exe
Size

7.5MB
MD5

db1d4f8a088ea413516fa2eb618dc43e
SHA1

02d51cc6d9ef3e6de1ad6d05172bb361c8219ee1
SHA256

25d97529fa389d0b36044fa44d7e8d80f6b00ca2d867d6d7371f5b97e088cdc2
SHA512

ccdc33b456a39c91aac446ef4585e8b440a0b66478fae58bb5c1831e30a6b4e0960a4322733a3358c3a1ad907fdaf5a7e7b6895142afe7009983a33f12aa4ae1
SSDEEP

196608:oqgVVE1TwfI9jUC2gYBYv3vbW2+iITx1U6n8:wVVE1gIH2gYBgDWJTnz8

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

SKIG UPDATED.exe

pid process

2644 SKIG UPDATED.exe

pid	process
2644	SKIG UPDATED.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI28082\python312.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SKIG UPDATED.exe

description	pid	process	target process
PID 2808 wrote to memory of 2644	2808	SKIG UPDATED.exe	SKIG UPDATED.exe
PID 2808 wrote to memory of 2644	2808	SKIG UPDATED.exe	SKIG UPDATED.exe
PID 2808 wrote to memory of 2644	2808	SKIG UPDATED.exe	SKIG UPDATED.exe

C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe
"C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe
  "C:\Users\Admin\AppData\Local\Temp\SKIG UPDATED.exe"
  2⤵
  - Loads dropped DLL
  PID:2644

C:\Users\Admin\AppData\Local\Temp\_MEI28082\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2644-23-0x000007FEF6720000-0x000007FEF6DE5000-memory.dmp

Filesize
6.8MB

Download