c17240a975134899ea29f3bb84e4d98464571d4f052a42c968d5d379ec8941e8

Analysis

max time kernel
66s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 17:39

Target

NeverLoseCrack.exe
Size

7.5MB
MD5

bd6cc5683c249bf454adedb3275dc4de
SHA1

e3de1872524a0a7223673b98af03e57dff30e497
SHA256

c17240a975134899ea29f3bb84e4d98464571d4f052a42c968d5d379ec8941e8
SHA512

8f51d3a7b769f966bb39bae5a09f78b8fc8755fd339578aa7adcd723241b2042bd6b63198ba4d1e0d63423bcf4f67e4c009ac1b2b8298b8f02fc523df09747e5
SSDEEP

196608:i6unqZ3wfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oSi:AhIH2XgHq+jq93Yov

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

NeverLoseCrack.exe

pid process

2144 NeverLoseCrack.exe

pid	process
2144	NeverLoseCrack.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI27722\python312.dll	upx
behavioral1/memory/2144-23-0x000007FEF58A0000-0x000007FEF5F62000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

NeverLoseCrack.exe

description	pid	process	target process
PID 2772 wrote to memory of 2144	2772	NeverLoseCrack.exe	NeverLoseCrack.exe
PID 2772 wrote to memory of 2144	2772	NeverLoseCrack.exe	NeverLoseCrack.exe
PID 2772 wrote to memory of 2144	2772	NeverLoseCrack.exe	NeverLoseCrack.exe

C:\Users\Admin\AppData\Local\Temp\NeverLoseCrack.exe
"C:\Users\Admin\AppData\Local\Temp\NeverLoseCrack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\NeverLoseCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\NeverLoseCrack.exe"
  2⤵
  - Loads dropped DLL
  PID:2144

C:\Users\Admin\AppData\Local\Temp\_MEI27722\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/2144-23-0x000007FEF58A0000-0x000007FEF5F62000-memory.dmp

Filesize
6.8MB

Download
memory/2144-44-0x000007FEF58A0000-0x000007FEF5F62000-memory.dmp

Filesize
6.8MB

Download