88ca35d1e1f29e9ecd1a23ff4b5b56ab7f2e371546ae50d9901ab21d80e2b4cc

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 00:12

Target

StarfallLauncherAlpha.exe
Size

80.7MB
MD5

c9d9b038cec093564dfe0f81423779d5
SHA1

ad3b61e052dc87252496bb9f77c5ebc9e94e4225
SHA256

88ca35d1e1f29e9ecd1a23ff4b5b56ab7f2e371546ae50d9901ab21d80e2b4cc
SHA512

3ad9f5bccb9fb8bae8797ea48f70c9ccb250c327ca30ad0823cc866e847af77709b3c253056326fdbe6e7e61543f51cd8fb8ceb850d37b6893d5e1fd12f182a4
SSDEEP

1572864:GGKlqWL4smwSk8IpG7V+VPhqclE7clifiYgj+h58sMw2erCcxycJ5A:XKMtsmwSkB05awcdwB5Ser9xA

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
676	StarfallLauncherAlpha.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020ab0-1264.dat	upx
behavioral1/memory/676-1266-0x000007FEF5230000-0x000007FEF5819000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 676	1196	StarfallLauncherAlpha.exe	30
PID 1196 wrote to memory of 676	1196	StarfallLauncherAlpha.exe	30
PID 1196 wrote to memory of 676	1196	StarfallLauncherAlpha.exe	30

C:\Users\Admin\AppData\Local\Temp\StarfallLauncherAlpha.exe
"C:\Users\Admin\AppData\Local\Temp\StarfallLauncherAlpha.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\StarfallLauncherAlpha.exe
  "C:\Users\Admin\AppData\Local\Temp\StarfallLauncherAlpha.exe"
  2⤵
  - Loads dropped DLL
  PID:676

C:\Users\Admin\AppData\Local\Temp\_MEI11962\python311.dll

Filesize
1.6MB

MD5
546cc5fe76abc35fdbf92f682124e23d

SHA1
5c1030752d32aa067b49125194befee7b3ee985a

SHA256
43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76

SHA512
cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720

Download Submit
memory/676-1266-0x000007FEF5230000-0x000007FEF5819000-memory.dmp

Filesize
5.9MB

Download