baa3e63d84d9010d4d054e32f051bd6eda685bccc9176f84ceacaa30aca17771

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 05:23

Target

Exela.exe
Size

9.3MB
MD5

9b710581e4d8ea6c794feee1bcf451a1
SHA1

6cef280dcd11ea850f9bb3f1502deea075b68a2d
SHA256

baa3e63d84d9010d4d054e32f051bd6eda685bccc9176f84ceacaa30aca17771
SHA512

ceeb8f3eb15ec65f7f01ba4ff5edcc0507a155dd442a278987fe8bb8a73dd566a637ad3f13d2fc746cce5eee50c5042e30f9669cce40b47b4a47ba7be8dd985d
SSDEEP

196608:K7SyWtIw5Ck6xfbaX8iiis4hTJURf+RHvUWvoRWOxu9kXwvdbDq03NLnpEhJj1/n:SpStBizaXZscJ6f+RHdGbAlbu03dpEnr

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2344	Exela.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019c79-46.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2344	2356	Exela.exe	30
PID 2356 wrote to memory of 2344	2356	Exela.exe	30
PID 2356 wrote to memory of 2344	2356	Exela.exe	30

C:\Users\Admin\AppData\Local\Temp\Exela.exe
"C:\Users\Admin\AppData\Local\Temp\Exela.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\Exela.exe
  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
  2⤵
  - Loads dropped DLL
  PID:2344

C:\Users\Admin\AppData\Local\Temp\_MEI23562\python310.dll

Filesize
1.4MB

MD5
26a40f85f4f17377dde2708ee37a5625

SHA1
f3e29b06631fbcb8c882f7171adae2991618b8cb

SHA256
9040c8db6a0040b0f9fd90b632114822f7786cb94beeb7755860edffada52462

SHA512
fbf6ed76bea9879b1efb3477141991cb287d1bed1c89d8c9fd0642182c50223e217384625cddde4421983e4885b2f3bf7b2e3e582be4009119a820f3e0ad94a9

Download Submit
memory/2344-48-0x000007FEF5D30000-0x000007FEF619A000-memory.dmp

Filesize
4.4MB

Download