1cc8e9d5a1194fde2e6d96873f943aad0b69ba821834ab7893f0d44519ac7ce7

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 17:11

Target

SteamToolsSetup.exe
Size

5.9MB
MD5

21173abe9a3834334776ca581aaf9d54
SHA1

a9ca53726a2421019d0dad6350e25ac48796129d
SHA256

1cc8e9d5a1194fde2e6d96873f943aad0b69ba821834ab7893f0d44519ac7ce7
SHA512

7ea2980b1bd5bf0636126aaaa8adb78f201e1c95f986af932537fa44bcfc83df1bf8446fa9f1bd52aff8400381760eb5a368c59abe0ba6b28701dd11bb2ecdb2
SSDEEP

98304:yQ+4S7SFi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeFkzkkqkg4gaP:yD4SYDOYjJlpZstQoS9Hf12VKXHztqwZ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3044	SteamToolsSetup.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019621-21.dat	upx
behavioral1/memory/3044-23-0x000007FEF6600000-0x000007FEF6A65000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 3044	2348	SteamToolsSetup.exe	30
PID 2348 wrote to memory of 3044	2348	SteamToolsSetup.exe	30
PID 2348 wrote to memory of 3044	2348	SteamToolsSetup.exe	30

C:\Users\Admin\AppData\Local\Temp\SteamToolsSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamToolsSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\SteamToolsSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SteamToolsSetup.exe"
  2⤵
  - Loads dropped DLL
  PID:3044

C:\Users\Admin\AppData\Local\Temp\_MEI23482\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/3044-23-0x000007FEF6600000-0x000007FEF6A65000-memory.dmp

Filesize
4.4MB

Download