d6fa0f7efc86f5e84415d40ad1f88c3da9f2cf7eec93563563dcb220675c4fa0

Resubmissions

01-12-2024 21:25

01-12-2024 21:19

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 21:19

Target

Bootstrapper1.exe
Size

81.0MB
MD5

2bc0fe8068f5b9594c8ae89947572bdc
SHA1

f444bfa901bc509b7b8d3001f79a04b515fd0437
SHA256

d6fa0f7efc86f5e84415d40ad1f88c3da9f2cf7eec93563563dcb220675c4fa0
SHA512

55db1b13156b294c22a57878f8be3fb47d431a83f989e1fb3f17a9c96edc81e8ee84dd319cccac8f86451e2f4d01d04804d4831172c967b4822d2e1e369a500f
SSDEEP

1572864:HGKlEWDsmwSk8IpG7V+VPhqYdfmE7cliwiYgj+h58sMwoyvhiDEN+wJq:mKeosmwSkB05awcf0wy5EyvGL

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1800	Bootstrapper1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020ab5-1264.dat	upx
behavioral1/memory/1800-1266-0x000007FEF6140000-0x000007FEF6732000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1800	2932	Bootstrapper1.exe	29
PID 2932 wrote to memory of 1800	2932	Bootstrapper1.exe	29
PID 2932 wrote to memory of 1800	2932	Bootstrapper1.exe	29

C:\Users\Admin\AppData\Local\Temp\Bootstrapper1.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper1.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper1.exe"
  2⤵
  - Loads dropped DLL
  PID:1800

C:\Users\Admin\AppData\Local\Temp\_MEI29322\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/1800-1266-0x000007FEF6140000-0x000007FEF6732000-memory.dmp

Filesize
5.9MB

Download