f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/12/2024, 23:05

Target

Bootstrapper.exe
Size

81.0MB
MD5

8e4459028b7b17ef356a8be2ad50c8ed
SHA1

084c9494f68755bc64e0fceb97834af2ccfec5d6
SHA256

f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6
SHA512

fc60a89d0516d38fa75bfbd45cc3edd483d8d879e20b7c885bbba1b839caa9e6aaa121b14b164e02dc4f3f189f58980eb0952b85f22c433237e42457a224d0ad
SSDEEP

1572864:AGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:5KeysmwSkB05awcfNwy5SybGW

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1284	Bootstrapper.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a53-1264.dat	upx
behavioral1/memory/1284-1266-0x000007FEF6180000-0x000007FEF6772000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1284	2644	Bootstrapper.exe	30
PID 2644 wrote to memory of 1284	2644	Bootstrapper.exe	30
PID 2644 wrote to memory of 1284	2644	Bootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:1284

C:\Users\Admin\AppData\Local\Temp\_MEI26442\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/1284-1266-0x000007FEF6180000-0x000007FEF6772000-memory.dmp

Filesize
5.9MB

Download