2bfbf65499c70040bec3ca02c44dfd3a6a589875224881bf5e5707e46a126799

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 04:31

Target

pizzasrolle_ddostool.exe
Size

7.6MB
MD5

776a2bbeea896973605cdd415293b52a
SHA1

29c2f38150329dfa79b634be4f4ff60e1de501d4
SHA256

2a2246e0933c66735c0c88541f20a738649b0caf18d8327c422b53f4019659b3
SHA512

e9a8f478943d322a5b52e797c6e7ae701e8e8606cbbbf63b1a59c7e509303c7b3f7254fcefbf3db29d85888d71e4508041b0b7ebd654d0a3fe3ee6fe5c840ae1
SSDEEP

196608:72HY/yCwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/j8:ZyBIHziK1piXLGVE4Ue0VJI

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1328	pizzasrolle_ddostool.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4c7-21.dat	upx
behavioral1/memory/1328-23-0x000007FEF5CA0000-0x000007FEF6303000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1328	2032	pizzasrolle_ddostool.exe	30
PID 2032 wrote to memory of 1328	2032	pizzasrolle_ddostool.exe	30
PID 2032 wrote to memory of 1328	2032	pizzasrolle_ddostool.exe	30

C:\Users\Admin\AppData\Local\Temp\pizzasrolle_ddostool.exe
"C:\Users\Admin\AppData\Local\Temp\pizzasrolle_ddostool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\pizzasrolle_ddostool.exe
  "C:\Users\Admin\AppData\Local\Temp\pizzasrolle_ddostool.exe"
  2⤵
  - Loads dropped DLL
  PID:1328

C:\Users\Admin\AppData\Local\Temp\_MEI20322\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
memory/1328-23-0x000007FEF5CA0000-0x000007FEF6303000-memory.dmp

Filesize
6.4MB

Download