eb70095e4a754231f8bc995108e5e99af07d092c300cfbe1b2cf6362be9dc3a5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 18:36

Target

index.exe
Size

6.9MB
MD5

80236fbd0ecaa7214f958cf4ec1ea3df
SHA1

21265ec65eeeed9dcad1f7a0d905bfffff6511b3
SHA256

eb70095e4a754231f8bc995108e5e99af07d092c300cfbe1b2cf6362be9dc3a5
SHA512

89976b720bc93ff671ae3f065c1186557c7a3d569d4bd79891cb513001de18ced0310410d7db930445e72e051d11c317f7218442f0583873b34224f83cdb5b78
SSDEEP

196608:vqV1B5wB6ylnlPzf+JiJCsmFMvraJb1Qms:4CBRlnlPSa7mmvraMms

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
864	index.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0005000000019467-21.dat	upx
behavioral1/memory/864-23-0x000007FEF5EA0000-0x000007FEF648A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 864	2204	index.exe	30
PID 2204 wrote to memory of 864	2204	index.exe	30
PID 2204 wrote to memory of 864	2204	index.exe	30

C:\Users\Admin\AppData\Local\Temp\index.exe
"C:\Users\Admin\AppData\Local\Temp\index.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\index.exe
  "C:\Users\Admin\AppData\Local\Temp\index.exe"
  2⤵
  - Loads dropped DLL
  PID:864

C:\Users\Admin\AppData\Local\Temp\_MEI22042\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/864-23-0x000007FEF5EA0000-0x000007FEF648A000-memory.dmp

Filesize
5.9MB

Download