dc007eedcc5771b76b7168e4be1c6b4f9b5a38cc358e94f9efe3ee53d245773b

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 02:46

Target

Condo generator/Condo generator.exe
Size

15.0MB
MD5

9b4f30c8171b1ed05efbd39090f83ca3
SHA1

a9754ed60a1a72bd21c9d4ab86cfdd450918c820
SHA256

86a3edf01329f734d35dbd4e263228b728bc4bcee07c795953ee27e2ea70d0dd
SHA512

5fb08c71f2da738fc26b45e1c7fa8227896f024a9a8bc49d0c31ad96fa9248e019eb0d78aea637fa6d9fe143b86dc3dc0b8188c1daa7ce64a87fe7e3674263cc
SSDEEP

196608:myHYrwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jh:VIHziK1piXLGVE4Ue0VJN

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Condo generator.exe

pid	Process
2344	Condo generator.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral21/files/0x0002000000024039-21.dat	upx
behavioral21/memory/2344-23-0x000007FEF5590000-0x000007FEF5BF3000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Condo generator.exe

description	pid	Process	procid_target
PID 2436 wrote to memory of 2344	2436	Condo generator.exe	30
PID 2436 wrote to memory of 2344	2436	Condo generator.exe	30
PID 2436 wrote to memory of 2344	2436	Condo generator.exe	30

C:\Users\Admin\AppData\Local\Temp\Condo generator\Condo generator.exe
"C:\Users\Admin\AppData\Local\Temp\Condo generator\Condo generator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\Condo generator\Condo generator.exe
  "C:\Users\Admin\AppData\Local\Temp\Condo generator\Condo generator.exe"
  2⤵
  - Loads dropped DLL
  PID:2344

C:\Users\Admin\AppData\Local\Temp\_MEI24362\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
memory/2344-23-0x000007FEF5590000-0x000007FEF5BF3000-memory.dmp

Filesize
6.4MB

Download