5f1992dd2b43541a02a77bccdb73ab2e47a17b9cd2a13e6a6cd40de2d12e7f20

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 07:55

Target

Mail Access Checker by xRisky v2 [Free version]/Data/Modules/Checker.exe
Size

6.0MB
MD5

7b23b16fb9cb368b3b282f96d5067229
SHA1

0393a31b074ce29a904e97929da620d3a2bc9f89
SHA256

7e55049a20a923847008b11dd7c0886ab0b88bc9cf612fd4548191453c4fc5c9
SHA512

57bc40d31995d451c1600de88e5f3c20253e63f248251033d2f92ab9d415c6d648ef4f1025e810ef7f561e7a45be6746de7a78da9a91467329145b6a40f0d8cf
SSDEEP

98304:r75PmoDUN43WlmljOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a5tMu:H5PumWMOjmFwDRxtYSHdK34kdai7bN3A

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
344	Checker.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a41c-21.dat	upx
behavioral1/memory/344-23-0x000007FEF6150000-0x000007FEF65B6000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 344	2804	Checker.exe	32
PID 2804 wrote to memory of 344	2804	Checker.exe	32
PID 2804 wrote to memory of 344	2804	Checker.exe	32

C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 [Free version]\Data\Modules\Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 [Free version]\Data\Modules\Checker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 [Free version]\Data\Modules\Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\Mail Access Checker by xRisky v2 [Free version]\Data\Modules\Checker.exe"
  2⤵
  - Loads dropped DLL
  PID:344

C:\Users\Admin\AppData\Local\Temp\_MEI28042\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/344-23-0x000007FEF6150000-0x000007FEF65B6000-memory.dmp

Filesize
4.4MB

Download
memory/344-44-0x000007FEF6150000-0x000007FEF65B6000-memory.dmp

Filesize
4.4MB

Download