61f63f2608d21e17b622e914039bc49ea851491505ac6f8b2082f0afadd63929

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 07:58

Target

Valid8Proxy/Data/Modules/Checker.exe
Size

6.0MB
MD5

7b23b16fb9cb368b3b282f96d5067229
SHA1

0393a31b074ce29a904e97929da620d3a2bc9f89
SHA256

7e55049a20a923847008b11dd7c0886ab0b88bc9cf612fd4548191453c4fc5c9
SHA512

57bc40d31995d451c1600de88e5f3c20253e63f248251033d2f92ab9d415c6d648ef4f1025e810ef7f561e7a45be6746de7a78da9a91467329145b6a40f0d8cf
SSDEEP

98304:r75PmoDUN43WlmljOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a5tMu:H5PumWMOjmFwDRxtYSHdK34kdai7bN3A

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3060	Checker.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral5/files/0x0005000000019c50-21.dat	upx
behavioral5/memory/3060-23-0x000007FEF6520000-0x000007FEF6986000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3060	3064	Checker.exe	31
PID 3064 wrote to memory of 3060	3064	Checker.exe	31
PID 3064 wrote to memory of 3060	3064	Checker.exe	31

C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe
"C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\Valid8Proxy\Data\Modules\Checker.exe"
  2⤵
  - Loads dropped DLL
  PID:3060

C:\Users\Admin\AppData\Local\Temp\_MEI30642\python310.dll

Filesize
1.4MB

MD5
4a6afa2200b1918c413d511c5a3c041c

SHA1
39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3

SHA256
bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da

SHA512
dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20

Download Submit
memory/3060-23-0x000007FEF6520000-0x000007FEF6986000-memory.dmp

Filesize
4.4MB

Download
memory/3060-44-0x000007FEF6520000-0x000007FEF6986000-memory.dmp

Filesize
4.4MB

Download