a5ce5fc1a69793f317e433cdc75ddc86ff19597e0355be3e82114fceabfec2e6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 14:54

Target

GenP-3.4.14.1.exe
Size

8.1MB
MD5

18286deb642a79bd9af012a30dc872c7
SHA1

8cd8afa5d4da303d1b1be482dc077e0f9cbc7a45
SHA256

a5ce5fc1a69793f317e433cdc75ddc86ff19597e0355be3e82114fceabfec2e6
SHA512

4240a7bc05d96de14169808313b44a43b3965cf9a408d1c391a045f8537ecd0aeb1a56ccbd02799a31c52539f10e8414f0af3e69695e8d7913b3e3a378987d7e
SSDEEP

196608:BB0cD9a1Ljv+bhqNVoBKUh8mz4Iv9PQv1DVa:8i9CL+9qz8/b4Imv3a

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

GenP-3.4.14.1.exe

pid	Process
2920	GenP-3.4.14.1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x0005000000018690-22.dat	upx
behavioral1/memory/2920-24-0x000007FEF5F40000-0x000007FEF6529000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

GenP-3.4.14.1.exe

description	pid	Process	procid_target
PID 2156 wrote to memory of 2920	2156	GenP-3.4.14.1.exe	30
PID 2156 wrote to memory of 2920	2156	GenP-3.4.14.1.exe	30
PID 2156 wrote to memory of 2920	2156	GenP-3.4.14.1.exe	30

C:\Users\Admin\AppData\Local\Temp\GenP-3.4.14.1.exe
"C:\Users\Admin\AppData\Local\Temp\GenP-3.4.14.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\GenP-3.4.14.1.exe
  "C:\Users\Admin\AppData\Local\Temp\GenP-3.4.14.1.exe"
  2⤵
  - Loads dropped DLL
  PID:2920

C:\Users\Admin\AppData\Local\Temp\_MEI21562\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
memory/2920-24-0x000007FEF5F40000-0x000007FEF6529000-memory.dmp

Filesize
5.9MB

Download