f09917d2ef0618e518048e45b668d4403aeca5db064953c1055f4543c43c2c9b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/11/2024, 17:43 UTC

Target

Built.exe
Size

5.9MB
MD5

e6f893eb863bbf2bc55753831a161809
SHA1

357b482f8bbdef2025a38e9b99bb401b28a34029
SHA256

f09917d2ef0618e518048e45b668d4403aeca5db064953c1055f4543c43c2c9b
SHA512

aa1b7c4aef24873333d732ce74c39d0ff3eac0d3ff3f33a513f8a39431c2d4a182217bff2eacbd94d7426ae49fd1eb696434673b7452fd2671cc5cfb3d2456bf
SSDEEP

98304:ic+iha9pi65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeF9zkkkkg4iOo:inisVDOYjJlpZstQoS9Hf12VKXGztkwK

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2108	Built.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001926c-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2108	1924	Built.exe	31
PID 1924 wrote to memory of 2108	1924	Built.exe	31
PID 1924 wrote to memory of 2108	1924	Built.exe	31

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2108

C:\Users\Admin\AppData\Local\Temp\_MEI19242\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/2108-23-0x000007FEF5820000-0x000007FEF5C85000-memory.dmp

Filesize
4.4MB

Download