ebbdf48aafe6c046eca7512a4e764629559392147518fdf2917751a891bfcd5d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 04:07

Target

SlottedAimV2.exe
Size

7.0MB
MD5

decace854bd66eba96581505cbb1f785
SHA1

dfd6824e2db3a2ebb89208f0e5f69e6cc1661da6
SHA256

ebbdf48aafe6c046eca7512a4e764629559392147518fdf2917751a891bfcd5d
SHA512

e55f8afc9a36913aaa24932a94b82100a53accd4f5d8865fc207c9b50c607efa259115d53d5926e0b45c99c0b9dece02996a6b8db5d365af122ccbcdd69823c8
SSDEEP

196608:WrSUf0qyleOjmFQR4MVGFtwLPCnL2hVcL:PVXKtM5LPCGcL

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2304	SlottedAimV2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a09e-22.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2304	2436	SlottedAimV2.exe	31
PID 2436 wrote to memory of 2304	2436	SlottedAimV2.exe	31
PID 2436 wrote to memory of 2304	2436	SlottedAimV2.exe	31

C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
"C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
  "C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
  2⤵
  - Loads dropped DLL
  PID:2304

C:\Users\Admin\AppData\Local\Temp\_MEI24362\python311.dll

Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
memory/2304-24-0x000007FEF6580000-0x000007FEF6B69000-memory.dmp

Filesize
5.9MB

Download