c99ef8a77872dcc4619828d3a89422e5f385b6f6146500f8683e145f968d9aed

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 22:15

Target

Built.exe
Size

5.9MB
MD5

5bc3f4b5d51eb836a100cfdaeb523463
SHA1

8d7e261a6f9db90cc24cab7ba4b9716ad89b066e
SHA256

c99ef8a77872dcc4619828d3a89422e5f385b6f6146500f8683e145f968d9aed
SHA512

bf5d9b435bbd40038096968ca0404bdfd4f55b231873dceef525bc26c5fee38837eab568da051ace5ee3587aec0c9dfe87ff306416eb1071ddcb0d9e606347c4
SSDEEP

98304:bo+nh24Ri65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeF49h/krfusU6:b7nZDOYjJlpZstQoS9Hf12VKXfb/C0VQ

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3036	Built.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019623-21.dat	upx
behavioral1/memory/3036-23-0x000007FEF6560000-0x000007FEF69C5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3036	2076	Built.exe	30
PID 2076 wrote to memory of 3036	2076	Built.exe	30
PID 2076 wrote to memory of 3036	2076	Built.exe	30

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\Built.exe"
  2⤵
  - Loads dropped DLL
  PID:3036

C:\Users\Admin\AppData\Local\Temp\_MEI20762\python310.dll

Filesize
1.4MB

MD5
b93eda8cc111a5bde906505224b717c3

SHA1
5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e

SHA256
efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983

SHA512
b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

Download Submit
memory/3036-23-0x000007FEF6560000-0x000007FEF69C5000-memory.dmp

Filesize
4.4MB

Download