71739aafa93c4527a94096f0140789e04c96c786d5f7cf6022e7d2ed338777e4

Analysis

max time kernel
4s
max time network
4s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 15:46

Target

Bootstrapper.exe
Size

81.0MB
MD5

840276a95bfdf1a3c03f97d34eefaadf
SHA1

d2bf4baf4096981ce08887ed91e88c1dfe5a1472
SHA256

71739aafa93c4527a94096f0140789e04c96c786d5f7cf6022e7d2ed338777e4
SHA512

e511cccd390d7d4bc3e3f818d453681d29c2927e4d576f8cd4e41755f7b7ab4a6563f6f56e1162351bf333ee110d4a55cf7f9c612e50e94b999c13fbbdeb6e50
SSDEEP

1572864:XGKlEWhsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:WKe4smwSkB05awcfNwy5SybGW

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2588	Bootstrapper.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a9f-1263.dat	upx
behavioral1/memory/2588-1265-0x000007FEF5B00000-0x000007FEF60F2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2588	2676	Bootstrapper.exe	30
PID 2676 wrote to memory of 2588	2676	Bootstrapper.exe	30
PID 2676 wrote to memory of 2588	2676	Bootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Loads dropped DLL
  PID:2588

C:\Users\Admin\AppData\Local\Temp\_MEI26762\python311.dll

Filesize
1.6MB

MD5
548809b87186356c7ac6421562015915

SHA1
8fa683eed7f916302c2eb1a548c12118bea414fa

SHA256
6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1

SHA512
c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc

Download Submit
memory/2588-1265-0x000007FEF5B00000-0x000007FEF60F2000-memory.dmp

Filesize
5.9MB

Download