410923e4a189208e753bd4d6fd554160fa66702e192066a2c4463a6ed517ac04

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 08:41

Target

source_prepared.exe
Size

80.7MB
MD5

ec3265280757262d51d820017fe3d788
SHA1

f635e8492f911209ee0f54502af8681d5ee46ccd
SHA256

410923e4a189208e753bd4d6fd554160fa66702e192066a2c4463a6ed517ac04
SHA512

db7aef4a7cf8eb4bc7bd56248b9acf31861e64e7f2642573ba2de7aea876ebdf379bf71c17f5d7b17922fa90d0da187f9a02174301d5f74a523e1f76b5a3b144
SSDEEP

1572864:ZpGKlgWj4smwSk8IpG7V+VPhqHJE70bli08iYgj+h58sMwrDuVZeT:ZgKi9smwSkB05awHfw025fiV

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2908	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a9e-1263.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2908	2684	source_prepared.exe	31
PID 2684 wrote to memory of 2908	2684	source_prepared.exe	31
PID 2684 wrote to memory of 2908	2684	source_prepared.exe	31

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2908

C:\Users\Admin\AppData\Local\Temp\_MEI26842\python311.dll

Filesize
1.6MB

MD5
87b5d21226d74f069b5ae8fb74743236

SHA1
153651a542db095d0f9088a97351b90d02b307ac

SHA256
3cac88119657daef7f79844aeb9da79b45c1f3bb2ea3468b0d4ed26067852194

SHA512
788bb26b3f4ce99a2b49eef2742972fe843bdd97d361a6e67237f29376648ea6f874f1f6ba6dd53c74ef51a29e650a02fb99dfc30b5badfa9d2e05491f81d7d6

Download Submit
memory/2908-1265-0x000007FEF56B0000-0x000007FEF5C98000-memory.dmp

Filesize
5.9MB

Download