b81671ff3d48bb80d4d1d98926227aa712cbdcd749e9675653fa946c4b638924

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 10:41

Target

source_prepared.exe
Size

76.7MB
MD5

4f308a42f2dc27b304b26dc5c57e4fb9
SHA1

c53c6020d6df0e8f0c31f707e00390ae3cb7b28b
SHA256

b81671ff3d48bb80d4d1d98926227aa712cbdcd749e9675653fa946c4b638924
SHA512

4a0026b8bd5f718f7d1577e4d03313a15e2de95eb2e76aecb3b47f4f52a1bb6df8aa974a3a46fe94088e8410b2d0643cd8c56db65ce5cd344af2313eba120219
SSDEEP

1572864:I1l2WhmUSk8IpG7V+VPhqFxE7alh8qAiYweyJulZUdgg4ZMcUKd72:I1sumUSkB05awFlLrpus4q8Z2

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2872	source_prepared.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00030000000209fd-1267.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2872	2900	source_prepared.exe	30
PID 2900 wrote to memory of 2872	2900	source_prepared.exe	30
PID 2900 wrote to memory of 2872	2900	source_prepared.exe	30

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
  "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
  2⤵
  - Loads dropped DLL
  PID:2872

C:\Users\Admin\AppData\Local\Temp\_MEI29002\python312.dll

Filesize
1.7MB

MD5
ce6ed19bcc516117af8d40d34707a52b

SHA1
b60be8c9cee76c2cbbbe168b7c631bc5e434e5e2

SHA256
52303626cdd89dd70dac6176aa11d2ec359789fc75b0ff2ab627cb9cf19d86b9

SHA512
127b8cd85e73210a202c1028037287b7948febf426cc743ed6483ec446174f57401c1e41426356fa7d207af3b2d175b38acb333b4f462a9e8f41969a6a761085

Download Submit
memory/2872-1269-0x000007FEF5460000-0x000007FEF5B22000-memory.dmp

Filesize
6.8MB

Download