d1ec383970d1d35bd37dfd7aae0ad32afe63724dea35b8f42c75b090544f413f

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 15:34

Target

Built.exe
Size

8.4MB
MD5

2d87ae5f76287a8e3bea496941786d77
SHA1

9890a7dd5d76f7764505f6fb7c06a561bbb79c1a
SHA256

d1ec383970d1d35bd37dfd7aae0ad32afe63724dea35b8f42c75b090544f413f
SHA512

1f3aed2addebcd6732014cf1b856bab44f978e5566377731b2361d5f6fd7b5ae0ef00e9552a37907251cefc2938590fadca5d87b367d26692ed1663077b1a0c0
SSDEEP

196608:Lg/bYPr7C0hzurErvI9pWjgfPvzm6gsFEY1iF:s/bar73urEUWjC3zDbf1O

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

Built.exe

pid	Process
2840	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x00060000000190cd-22.dat	upx
behavioral1/memory/2840-24-0x000007FEF59C0000-0x000007FEF5FB2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Built.exe

description	pid	Process	procid_target
PID 2408 wrote to memory of 2840	2408	Built.exe	30
PID 2408 wrote to memory of 2840	2408	Built.exe	30
PID 2408 wrote to memory of 2840	2408	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:2840

C:\Users\Admin\AppData\Local\Temp\_MEI24082\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2840-24-0x000007FEF59C0000-0x000007FEF5FB2000-memory.dmp

Filesize
5.9MB

Download