94191717090effe8e6f4e6b21169189cfde2efe0d3ab094089fb1c51c7d17870

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 21:59

Target

Howl/build.exe
Size

78.4MB
MD5

eae3bbe73213fd0b4c9b315673270d06
SHA1

cda6ec591899c5b5bfa61c8bd25a4d87d23a8830
SHA256

36b652e060aef8ddcef266da7864afeaf3700121ef70483e830c7a23709282ac
SHA512

0c51f85adcba2335f780c0e391e7a47d7fa121c3f2907ed4eca5ef2f9a1d4c561edfb00a906aa851723f7840267f47cc1be09d31da3f4ac8316d556ad12ab13c
SSDEEP

1572864:jGKlgWjLSk8IpG7V+VPhqHJE7bbli08iYgj+h58sMwJDsZcj:KKiaSkB05awHAw0251Q

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2608	build.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/files/0x0003000000020a1b-1256.dat	upx
behavioral5/memory/2608-1258-0x000007FEF5BC0000-0x000007FEF61A8000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	build.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2608	2324	build.exe	28
PID 2324 wrote to memory of 2608	2324	build.exe	28
PID 2324 wrote to memory of 2608	2324	build.exe	28

C:\Users\Admin\AppData\Local\Temp\Howl\build.exe
"C:\Users\Admin\AppData\Local\Temp\Howl\build.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\Howl\build.exe
  "C:\Users\Admin\AppData\Local\Temp\Howl\build.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2608

C:\Users\Admin\AppData\Local\Temp\_MEI23242\python311.dll

Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/2608-1258-0x000007FEF5BC0000-0x000007FEF61A8000-memory.dmp

Filesize
5.9MB

Download
memory/2608-1259-0x000007FEF5BC0000-0x000007FEF61A8000-memory.dmp

Filesize
5.9MB

Download