6a125187b5e4a066c6987496ad366502f00695bb5313869a0594754c67147a26

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 22:55

Target

Bootstrapper.exe
Size

81.0MB
MD5

7f2b49320b43a5f2062f00c715dc59ba
SHA1

c70105d56ed85f795233e1f24f13076ac5f19294
SHA256

6a125187b5e4a066c6987496ad366502f00695bb5313869a0594754c67147a26
SHA512

f3dd500e08644586ab198dfdabea4da1e70cfcf44746e53f8efa2ae88f0abe3ed36212db4752c24389bfc812e38d8febdeefdb74f7fece69c8c0e93d70423d20
SSDEEP

1572864:KGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:TKeysmwSkB05awcfNwy5SybGW

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2736	Bootstrapper.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00030000000209ce-1264.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2736	3028	Bootstrapper.exe	30
PID 3028 wrote to memory of 2736	3028	Bootstrapper.exe	30
PID 3028 wrote to memory of 2736	3028	Bootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:2736

C:\Users\Admin\AppData\Local\Temp\_MEI30282\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/2736-1266-0x000007FEF5FA0000-0x000007FEF6592000-memory.dmp

Filesize
5.9MB

Download