d473f03ab8322ad35b5eb34cee854d67f48c8f1cfcab5a28119149fbfeb8137a

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 16:14

Target

woofer.exe
Size

5.8MB
MD5

df7d7682219321201a496fac6f776747
SHA1

cd7de98ae7c3d71d0752e1ca9fa5165e8bb74073
SHA256

d473f03ab8322ad35b5eb34cee854d67f48c8f1cfcab5a28119149fbfeb8137a
SHA512

5136f6349140ad98e3640ce1192a37b730bb640effa033cb9d1c55febee99eb1b239014f828f06e338687031c289e9b28014ee207f284bc227933329ef628561
SSDEEP

98304:LimDSuXFRHtJQi9UWvGfqD8WOxfmjaa15uXaDvdCK/blzFS03iw7FwXR6nOetJ8m:LimDZVRHvUWvozWOxu9kXwvdbDlA03NN

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
3060	woofer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019506-21.dat	upx
behavioral1/memory/3060-23-0x000007FEF6690000-0x000007FEF6AFA000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3060	2668	woofer.exe	30
PID 2668 wrote to memory of 3060	2668	woofer.exe	30
PID 2668 wrote to memory of 3060	2668	woofer.exe	30

C:\Users\Admin\AppData\Local\Temp\woofer.exe
"C:\Users\Admin\AppData\Local\Temp\woofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\woofer.exe
  "C:\Users\Admin\AppData\Local\Temp\woofer.exe"
  2⤵
  - Loads dropped DLL
  PID:3060

C:\Users\Admin\AppData\Local\Temp\_MEI26682\python310.dll

Filesize
1.4MB

MD5
b3ae142a88ff3760a852ba7facb901bc

SHA1
ad23e5f2f0cc6415086d8c8273c356d35fa4e3ee

SHA256
2291ce67c4be953a0b7c56d790b6cc8075ec8166b1b2e05d71f684c59fdd91a5

SHA512
3b60b8b7197079d629d01440ed78a589c6a18803cc63cdeac1382dc76201767f18190e694d2c1839a72f6318e39dba6217c48a130903f72e47fa1db504810c1c

Download Submit
memory/3060-23-0x000007FEF6690000-0x000007FEF6AFA000-memory.dmp

Filesize
4.4MB

Download