1a7df35f784e28fc2c020afe938679002a16ff39f3e4e0a84e64e6ab45767bb8

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 17:40

Target

TTSPLOIT.exe
Size

76.6MB
MD5

54b143c1e5800018f0cd04289444e2eb
SHA1

5e98471241664a146d96c5cb072c6081f6c91e23
SHA256

1a7df35f784e28fc2c020afe938679002a16ff39f3e4e0a84e64e6ab45767bb8
SHA512

218e555ef316a1cf3e95d007939b6e91513de4d52bc9d3ac5db6df637be23f38f00c3a2a2c3cfafd603d0c11abd45f690fc684cbb44411dfa15332c521b88bc5
SSDEEP

1572864:i1lfWMHmUSk8IpG7V+VPhqYdfzE7xFlhq4iYweyJulZUdgM34jiybL/Z9Ui:i1F7mUSkB05awcfSLypuQ3gh9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
852	TTSPLOIT.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a6a-1268.dat	upx
behavioral1/memory/852-1270-0x000007FEF5D40000-0x000007FEF6404000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 852	1916	TTSPLOIT.exe	30
PID 1916 wrote to memory of 852	1916	TTSPLOIT.exe	30
PID 1916 wrote to memory of 852	1916	TTSPLOIT.exe	30

C:\Users\Admin\AppData\Local\Temp\TTSPLOIT.exe
"C:\Users\Admin\AppData\Local\Temp\TTSPLOIT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\TTSPLOIT.exe
  "C:\Users\Admin\AppData\Local\Temp\TTSPLOIT.exe"
  2⤵
  - Loads dropped DLL
  PID:852

C:\Users\Admin\AppData\Local\Temp\_MEI19162\python312.dll

Filesize
1.7MB

MD5
506c760a20e6bb940590229d41449ffa

SHA1
b7c439f253987fb0ff66fc5ce959cf711b18eb8d

SHA256
e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5

SHA512
34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e

Download Submit
memory/852-1270-0x000007FEF5D40000-0x000007FEF6404000-memory.dmp

Filesize
6.8MB

Download