9c5e3df7c7a2750b106dc50871d9e896081f473ead5c10dccdfb1e4886e8c708

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 20:57

Target

BuhariKeyGen.exe
Size

6.0MB
MD5

d2f7d0fd631a500f39c763112d9cc012
SHA1

88a1a52c9505e67f833e7ea37d745b2f195f0ee1
SHA256

9c5e3df7c7a2750b106dc50871d9e896081f473ead5c10dccdfb1e4886e8c708
SHA512

5379c49ace62615ed5d8a4f5772131269f56ac3d14d2465f01df5a47c0363d2faf0f2261263023f1b1882400913d703e465f469fe7de6e0cc9959bd838aa22fc
SSDEEP

98304:qMIu4+DcdvtamaHl3Ne4i3gDUZnhhM7M+yvFaW9cIzaF6ARwDtyDe2HdMlq3yMXL:qPp+DmgeNoInY7/sHfbRy9qlqHTn

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
1720	BuhariKeyGen.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x00050000000195cc-21.dat	upx
behavioral1/memory/1720-23-0x000007FEF5C10000-0x000007FEF607E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1720	2184	BuhariKeyGen.exe	30
PID 2184 wrote to memory of 1720	2184	BuhariKeyGen.exe	30
PID 2184 wrote to memory of 1720	2184	BuhariKeyGen.exe	30

C:\Users\Admin\AppData\Local\Temp\BuhariKeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\BuhariKeyGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\BuhariKeyGen.exe
  "C:\Users\Admin\AppData\Local\Temp\BuhariKeyGen.exe"
  2⤵
  - Loads dropped DLL
  PID:1720

C:\Users\Admin\AppData\Local\Temp\_MEI21842\python310.dll

Filesize
1.4MB

MD5
01988415e8fb076dcb4a0d0639b680d9

SHA1
91b40cffcfc892924ed59dc0664c527ff9d3f69c

SHA256
b101db1ddd659b8d8ffd8b26422fde848d5b7846e0c236f051fadb9412de6e24

SHA512
eab0c3ca4578751a671beb3da650b5e971a79798deb77472e42f43aa2bea7434ad5228a8fddbfff051ce05054dbf3422d418f42c80bc3640e0e4f43a0cf2ebbe

Download Submit
memory/1720-23-0x000007FEF5C10000-0x000007FEF607E000-memory.dmp

Filesize
4.4MB

Download