5c7026ad4e69c6fc5909613a63be5f5ee298dc5d55ef20cd9639d52afb562afa

Analysis

max time kernel
15s
max time network
0s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 06:39

Target

Built.exe
Size

7.5MB
MD5

9681b16e9b2bc26f93b8147310336eb8
SHA1

332dc32e98d6eeb6ad3804b80dc7e10080b0b5f3
SHA256

5c7026ad4e69c6fc5909613a63be5f5ee298dc5d55ef20cd9639d52afb562afa
SHA512

5dc9da06dee292f2a3f471aa919d902ff45578e5bd273500e1a82e54f1d041b42b206e4d91e0284d15aaefb5bc399afcc8acb66091b805c1390d4ec730a5e821
SSDEEP

196608:zSQCwuLDurErvI9pWjgN3ZdahF0pbH1AY7CtQsNI/Sx3C1J:DAurEUWjqeWxA6nAYJ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Built.exe

pid	Process
2880	Built.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x00060000000190d6-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Built.exe

description	pid	Process	procid_target
PID 2496 wrote to memory of 2880	2496	Built.exe	30
PID 2496 wrote to memory of 2880	2496	Built.exe	30
PID 2496 wrote to memory of 2880	2496	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2880

C:\Users\Admin\AppData\Local\Temp\_MEI24962\python312.dll

Filesize
1.7MB

MD5
18677d48ba556e529b73d6e60afaf812

SHA1
68f93ed1e3425432ac639a8f0911c144f1d4c986

SHA256
8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

SHA512
a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

Download Submit
memory/2880-23-0x000007FEF5F30000-0x000007FEF65F4000-memory.dmp

Filesize
6.8MB

Download