a04e02f81cb59df2544fcb69df9489cd78444f05eda3db63260a2c62134718fd

Resubmissions

17-11-2024 07:16

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 07:16

Target

Depart.exe
Size

7.4MB
MD5

600ff2b2bc06dc4349d23066f49fb171
SHA1

229f87b2653ec2362fc227ad770a1a2718134f2d
SHA256

a04e02f81cb59df2544fcb69df9489cd78444f05eda3db63260a2c62134718fd
SHA512

1bbfcf2c3e4f66046db1f2deec32371e9072a9d732e590dcd812bb6eec53c335af483f4b741a87eba214175df29c88dea0cf62f43e495493ff2de5ab8eac3664
SSDEEP

98304:ElSi8TRtlurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EwKhOh112mJR:EUNlurErvI9pWjgfPvzm6gsFEF4fZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Depart.exe

pid	Process
1864	Depart.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x00050000000194f3-21.dat	upx
behavioral1/memory/1864-23-0x000007FEF5780000-0x000007FEF5D72000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Depart.exe

description	pid	Process	procid_target
PID 2492 wrote to memory of 1864	2492	Depart.exe	30
PID 2492 wrote to memory of 1864	2492	Depart.exe	30
PID 2492 wrote to memory of 1864	2492	Depart.exe	30

C:\Users\Admin\AppData\Local\Temp\Depart.exe
"C:\Users\Admin\AppData\Local\Temp\Depart.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\Depart.exe
  "C:\Users\Admin\AppData\Local\Temp\Depart.exe"
  2⤵
  - Loads dropped DLL
  PID:1864

C:\Users\Admin\AppData\Local\Temp\_MEI24922\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/1864-23-0x000007FEF5780000-0x000007FEF5D72000-memory.dmp

Filesize
5.9MB

Download