eee4cedb41e61dbfd4c6b7838b57661a2fffdda006a1bc957d23d703ec316901

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 13:40

Target

spoofer/mapper.exe
Size

7.5MB
MD5

4f8ee6ff1ed295b4227a8e9e536c9a48
SHA1

204116eef3f0d564240d4082d5dea7c89d98495e
SHA256

e29649ae22328d57f3f6ec42d10bdf496b3d62351e6c90ab070f9bd966e22cfc
SHA512

441941116f6c815dbed18639a519aae55d494b199625c22e668a54e1583fe14181fb464047e951391efc4b6740eb25a59040f13c13cc7fcc5d833400cb2d69ae
SSDEEP

196608:9hgFO2gDwfI9jUC2gYBYv3vbW5+iITm1U6fE:8FO2gwIH2gYBgDW4TOzc

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

mapper.exe

pid	Process
2080	mapper.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral5/files/0x000500000001a41a-21.dat	upx
behavioral5/memory/2080-23-0x000007FEF61E0000-0x000007FEF68A5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

mapper.exe

description	pid	Process	procid_target
PID 2500 wrote to memory of 2080	2500	mapper.exe	30
PID 2500 wrote to memory of 2080	2500	mapper.exe	30
PID 2500 wrote to memory of 2080	2500	mapper.exe	30

C:\Users\Admin\AppData\Local\Temp\spoofer\mapper.exe
"C:\Users\Admin\AppData\Local\Temp\spoofer\mapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\spoofer\mapper.exe
  "C:\Users\Admin\AppData\Local\Temp\spoofer\mapper.exe"
  2⤵
  - Loads dropped DLL
  PID:2080

C:\Users\Admin\AppData\Local\Temp\_MEI25002\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2080-23-0x000007FEF61E0000-0x000007FEF68A5000-memory.dmp

Filesize
6.8MB

Download