fa32637cae3946dde9c891fcb5efbe89796ecc1f59f62d69dad84cb7b0272db8

Analysis

max time kernel
14s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 15:07

Target

GenPrep-3.4.14.1.exe
Size

81.1MB
MD5

45acdce6222875556ce43aec968f184e
SHA1

1a68a1d7676563f61dfc5ea26a5a811a9d6c5bc3
SHA256

fa32637cae3946dde9c891fcb5efbe89796ecc1f59f62d69dad84cb7b0272db8
SHA512

e00542b87a2f858f889d59e0110f4e3b02da4c8a09de7c440e3464f4d97748e20ed3c463c9815e75ef5194f0d88e1762915e2cd0526c5336633dbd48a8450daf
SSDEEP

1572864:RGKlXshW60hSk8IpG7V+VPhqO+ynE7sli9iYgj+h58sMwIIHerGnXQcJFg:oKROESkB05awO+yvwH5k2era5g

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2180	GenPrep-3.4.14.1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020afb-1264.dat	upx
behavioral1/memory/2180-1266-0x000007FEF6720000-0x000007FEF6D09000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2180	1756	GenPrep-3.4.14.1.exe	29
PID 1756 wrote to memory of 2180	1756	GenPrep-3.4.14.1.exe	29
PID 1756 wrote to memory of 2180	1756	GenPrep-3.4.14.1.exe	29

C:\Users\Admin\AppData\Local\Temp\GenPrep-3.4.14.1.exe
"C:\Users\Admin\AppData\Local\Temp\GenPrep-3.4.14.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\GenPrep-3.4.14.1.exe
  "C:\Users\Admin\AppData\Local\Temp\GenPrep-3.4.14.1.exe"
  2⤵
  - Loads dropped DLL
  PID:2180

C:\Users\Admin\AppData\Local\Temp\_MEI17562\python311.dll

Filesize
1.6MB

MD5
0b66c50e563d74188a1e96d6617261e8

SHA1
cfd778b3794b4938e584078cbfac0747a8916d9e

SHA256
02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

SHA512
37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

Download Submit
memory/2180-1266-0x000007FEF6720000-0x000007FEF6D09000-memory.dmp

Filesize
5.9MB

Download