20b6c6dbdced0efe73c69094bef2d1798f3623cd125664545249b2a705a6f143

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 16:48

Target

ElectronV3.exe
Size

9.9MB
MD5

2ce21c54d64e7c248b64fe712bf7494d
SHA1

09fb64a174b68814433971a0e58ce00f34eb8229
SHA256

20b6c6dbdced0efe73c69094bef2d1798f3623cd125664545249b2a705a6f143
SHA512

3f5d09688feeec94d4b2c72cbb0604ce6f9705e618293d2f98d7bafdf7908fed65b8e3275350aa491498df06b31b0953fca8e86ae7d999774c2a2a5245d00b58
SSDEEP

196608:eCkS7Gpe1xh0/TLx4hz7DIxygRHvUWvothxjno/w3iFCxHQbRpXf2rTpU:Pn74TGz7kFRHdqxro/w3uCxHQbWTp

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2744	ElectronV3.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019203-47.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2744	2672	ElectronV3.exe	30
PID 2672 wrote to memory of 2744	2672	ElectronV3.exe	30
PID 2672 wrote to memory of 2744	2672	ElectronV3.exe	30

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:2744

C:\Users\Admin\AppData\Local\Temp\_MEI26722\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2744-49-0x000007FEF5F60000-0x000007FEF63C5000-memory.dmp

Filesize
4.4MB

Download