56379b064e202cd74f3782c86ed557021995c573318bc9f6d02d855d4e493243

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 21:07

Target

aware-spoofer.v2.exe
Size

9.0MB
MD5

b18293b4142de2ccc31567a781b01fa5
SHA1

f796c15aa3c529a8b7ede29214926411fb17f4b7
SHA256

56379b064e202cd74f3782c86ed557021995c573318bc9f6d02d855d4e493243
SHA512

f4e359a62ba985700d241e8d99081266726b9cfd99d427f9fdbc947dbbf709bc510ef54f14ad4c9eb30b1cd2092075d6d3288d62b51476aa95736e5612d656a4
SSDEEP

196608:ASHYcwjwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jj:/wQIHziK1piXLGVE4Ue0VJ3

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2324	aware-spoofer.v2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019502-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2324	3064	aware-spoofer.v2.exe	30
PID 3064 wrote to memory of 2324	3064	aware-spoofer.v2.exe	30
PID 3064 wrote to memory of 2324	3064	aware-spoofer.v2.exe	30

C:\Users\Admin\AppData\Local\Temp\aware-spoofer.v2.exe
"C:\Users\Admin\AppData\Local\Temp\aware-spoofer.v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\aware-spoofer.v2.exe
  "C:\Users\Admin\AppData\Local\Temp\aware-spoofer.v2.exe"
  2⤵
  - Loads dropped DLL
  PID:2324

C:\Users\Admin\AppData\Local\Temp\_MEI30642\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
memory/2324-23-0x000007FEF60D0000-0x000007FEF6733000-memory.dmp

Filesize
6.4MB

Download