ee26f6730dc7e98e754126400f120bc654037b9dd7646757d3d20eb8c7500833

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 17:13

Target

privexternal.exe
Size

7.5MB
MD5

df176de82c037b3405acfd0a85d0889b
SHA1

417ed55c786d7941325d6851f57d5b46883d674e
SHA256

ee26f6730dc7e98e754126400f120bc654037b9dd7646757d3d20eb8c7500833
SHA512

bdc929043bcec8f7537c7968a642b576c24d652e7fe8b221f4f4bf7d6e4e32f8dd092519f0e93711c28b4c5c3ede90ffaa7a02312bc8ae2aa6cd7e2a9a0aeeaa
SSDEEP

196608:bxunqZcewfI9jUC2XMvH8zPjweaBpZ0cX2ooccXK7oSC:YLIH2XgHq+jq93YoP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

privexternal.exe

pid	Process
2604	privexternal.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/files/0x00050000000197c1-21.dat	upx
behavioral1/memory/2604-23-0x000007FEF5760000-0x000007FEF5E22000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

privexternal.exe

description	pid	Process	procid_target
PID 2472 wrote to memory of 2604	2472	privexternal.exe	30
PID 2472 wrote to memory of 2604	2472	privexternal.exe	30
PID 2472 wrote to memory of 2604	2472	privexternal.exe	30

C:\Users\Admin\AppData\Local\Temp\privexternal.exe
"C:\Users\Admin\AppData\Local\Temp\privexternal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\privexternal.exe
  "C:\Users\Admin\AppData\Local\Temp\privexternal.exe"
  2⤵
  - Loads dropped DLL
  PID:2604

C:\Users\Admin\AppData\Local\Temp\_MEI24722\python312.dll

Filesize
1.7MB

MD5
2996cbf9598eb07a64d66d4c3aba4b10

SHA1
ac176ab53cdef472770d27a38db5bd6eb71a5627

SHA256
feba57a74856dedb9d9734d12c640ca7f808ead2db1e76a0f2bcf1e4561cd03f

SHA512
667e117683d94ae13e15168c477800f1cd8d840e316890ec6f41a6e4cefd608536655f3f6d7065c51c6b1b8e60dd19aa44da3f9e8a70b94161fd7dc3abf5726c

Download Submit
memory/2604-23-0x000007FEF5760000-0x000007FEF5E22000-memory.dmp

Filesize
6.8MB

Download