24362ff6a324800a9cdea2d023dfbe4f21b195c4ea3ad51c4dc9c9cfecdf4c87

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 04:00

Target

creed.exe
Size

76.8MB
MD5

4a06d4abd4e05eaed76afe296fd5df01
SHA1

51921b6d814044b00cc4bc9dd04a76eee840071c
SHA256

24362ff6a324800a9cdea2d023dfbe4f21b195c4ea3ad51c4dc9c9cfecdf4c87
SHA512

e70fec831ba539796460f7c05f39f1f239921310854872aeaaf171c6542cbc090fa8ebe14ffe379698b12d4270b3cfb1920e65d9c3dfb8de8e90f48319fcfdd5
SSDEEP

1572864:h41lfWMHmUSk8IpG7V+VPhqYdfzE7xFlhq4iYweyJulZUdgM34iRybL/Z9Ui:h41F7mUSkB05awcfSLypuQ3qh9U

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2248	creed.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0003000000020a8f-1268.dat	upx
behavioral1/memory/2248-1270-0x000007FEF59B0000-0x000007FEF6074000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2248	2184	creed.exe	30
PID 2184 wrote to memory of 2248	2184	creed.exe	30
PID 2184 wrote to memory of 2248	2184	creed.exe	30

C:\Users\Admin\AppData\Local\Temp\creed.exe
"C:\Users\Admin\AppData\Local\Temp\creed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\creed.exe
  "C:\Users\Admin\AppData\Local\Temp\creed.exe"
  2⤵
  - Loads dropped DLL
  PID:2248

C:\Users\Admin\AppData\Local\Temp\_MEI21842\python312.dll

Filesize
1.7MB

MD5
506c760a20e6bb940590229d41449ffa

SHA1
b7c439f253987fb0ff66fc5ce959cf711b18eb8d

SHA256
e63503b2715df3eab8abb9b2682129e27a7add9acea9008f06f55494a2b2f3d5

SHA512
34df2e8e53caac0cd72cb3c5848296ca8cfa10c542c0a5f88385d6b35ab70b86957540de2ff105a27cefb37ccbb5789261a69132b535a857df32875c1f9deb9e

Download Submit
memory/2248-1270-0x000007FEF59B0000-0x000007FEF6074000-memory.dmp

Filesize
6.8MB

Download