106b4c8e76afb25e9f4dc839a85bccb709713b90320ea103b062b8a644ce627f

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/12/2024, 04:53

Target

defender.exe
Size

50.1MB
MD5

cdfb5e2a9eb82de7147eace7aa822cf5
SHA1

64a3f803a9488a1a166cdd257f6fdac13bc6fcc0
SHA256

106b4c8e76afb25e9f4dc839a85bccb709713b90320ea103b062b8a644ce627f
SHA512

24644afa345d6f3778a5c77e50269d8273455b9e72cddabc9525db2b47cbb4b89b45adff4cde1fd7b82019dd54ac1cf4adfeb8bf94e0bb9158ed7c643fce2c30
SSDEEP

1572864:q1lBWBiSk8IpG7V+VPhqFxE76lhpBBU7mViizwvJ:q1r2iSkB05awFJLpnU7+i0u

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2832	defender.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a8f-1157.dat	upx
behavioral1/memory/2832-1159-0x000007FEF6300000-0x000007FEF69C5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2832	2644	defender.exe	30
PID 2644 wrote to memory of 2832	2644	defender.exe	30
PID 2644 wrote to memory of 2832	2644	defender.exe	30

C:\Users\Admin\AppData\Local\Temp\defender.exe
"C:\Users\Admin\AppData\Local\Temp\defender.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\defender.exe
  "C:\Users\Admin\AppData\Local\Temp\defender.exe"
  2⤵
  - Loads dropped DLL
  PID:2832

C:\Users\Admin\AppData\Local\Temp\_MEI26442\python312.dll

Filesize
1.7MB

MD5
71070618402c15a2fad5ca70c9ef7297

SHA1
34fedbf17a57010c5cd20ef4e690616859cc8e68

SHA256
7d35a191edb95ccd85ef05d645deeca3ed1febd9acd659569fab56ae06c1ebdf

SHA512
81ef8749f5c3dbd586ddbbcf26cd6c80607a5cc9c26e31c912f454ca56013082174e2012a507739ec1e9c5a2f019bf0ca6bd3ce18880abdbff0ba5f8f3cbbf28

Download Submit
memory/2832-1159-0x000007FEF6300000-0x000007FEF69C5000-memory.dmp

Filesize
6.8MB

Download