d9671229e05ec507b1b97e7ffd535c871e9856d96e2276197f89c9afd97725a2

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 11:59

Target

CondoGenerator.exe
Size

7.6MB
MD5

aca20efda4d895c0936f9afc03773792
SHA1

0b44158a9de2a1f04831337efe27c3a46fac7a11
SHA256

d9671229e05ec507b1b97e7ffd535c871e9856d96e2276197f89c9afd97725a2
SHA512

610a954e792a08a0e43c385e1dd98695be6c62d30d34e374269d7addd4fdb7a9ea1a763e13f7e444089b0663eb21e249cd60ad564eef94563c8a03e1b1a9ac8d
SSDEEP

196608:TEHYGHSwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jJ:2RIHziK1piXLGVE4Ue0VJF

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2704	CondoGenerator.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001925b-21.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2704	2172	CondoGenerator.exe	30
PID 2172 wrote to memory of 2704	2172	CondoGenerator.exe	30
PID 2172 wrote to memory of 2704	2172	CondoGenerator.exe	30

C:\Users\Admin\AppData\Local\Temp\CondoGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\CondoGenerator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\CondoGenerator.exe
  "C:\Users\Admin\AppData\Local\Temp\CondoGenerator.exe"
  2⤵
  - Loads dropped DLL
  PID:2704

C:\Users\Admin\AppData\Local\Temp\_MEI21722\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
memory/2704-23-0x000007FEF5770000-0x000007FEF5DD3000-memory.dmp

Filesize
6.4MB

Download